kimi-plugin-cc 2.5.1 → 2.5.3

package/docs/swarm-recovery.md

@@ -2,7 +2,7 @@
 
 Normal stop: use `scripts/companion.sh cancel` for a shell-owned run, or the MCP job cancel tool for an MCP-owned run. A hard kill cannot execute cleanup. Cancellation still starts no fresh cleanup server.
 
-For exact CLI 2.3.2, 2.3.3, 2.4.0 and 2.4.1 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
+For exact CLI 2.3.2, 2.3.3, 2.4.0, 2.4.1 and 2.5.0/2.5.1 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
 
 ## Preview, then recover
 
@@ -17,7 +17,7 @@ Preview does not signal processes, modify sessions, or capture patches. Apply:
 
 1. Requires the original companion to be gone and acquires an identity-checked recovery claim. A second recovery cannot race the first; a dead recovery owner can be reclaimed by compare-and-swap.
 2. Revalidates recorded processes and groups. It stops only verified individual identities, never a guessed PID or unproven group. An unknown surviving group member, changed group, incomplete probe or unrecorded launch refuses recovery.
-3. If session cleanup is pending, requires the selected exact certified CLI and valid managed hook. It starts one bounded authenticated web lifecycle, disables the recorded session's swarm mode, verifies status and the exit journal, then verifies process quiescence. It does not resume a prompt, generate model output, install hooks or retry failed cleanup automatically. New recovery web launches are themselves journaled.
+3. If session cleanup is pending, requires the selected exact certified CLI and valid managed hook. It starts one bounded authenticated web lifecycle, disables the recorded session's swarm mode, verifies the version-appropriate state proof and exit journal, then verifies process quiescence. On 2.5.0/2.5.1 this includes the local environment binding and protocol-v2 WebSocket main-agent state rather than `/status`. It does not resume a prompt, generate model output, install hooks or retry failed cleanup automatically. New recovery web launches are themselves journaled.
 4. Captures a binary patch from a retained write worktree. It does not apply the patch or delete the tree. The result names both paths for inspection.
 
 The recovery attempt has a 30-second cancellation signal, with bounded identity probes and normal teardown. Interrupting recovery retains its journal. An already-recovered record is an idempotent no-op. Failed/cancelled/completed job outcomes are immutable; a previously running abandoned job becomes failed, never completed. Recovery status is separate from task success.

package/docs/upstream-2.5.0-certification.md

@@ -0,0 +1,48 @@
+# Kimi Code 2.5.0 certification evidence — 2026-11-05
+
+## Status and exact source
+
+**Exact CLI 2.5.0 is certified for all eight operations by the plugin 2.5.2 working tree.** The exact-source audit, non-vacuous plan and swarm controls, local-environment controls, candidate matrix, and production-table matrix passed. Repository and package validation results are recorded below as they complete. Commit, push, tag, publication, installed-host rollout, and operator CLI pin changes are outside this certification slice and were not performed.
+
+Candidate: `@moonshot-ai/kimi-code@2.5.0`, release commit `41c341434ae24e45bfe0f2232ec11b80531ac717`, compared with certified 2.4.1 (`2c73f3f50af4fa7f2540ca0d2e33b07a1408e3a7`). The monitor recorded npm publication at 2026-11-04T11:59:13.163Z. A temporary isolated npm installation and its executable both report 2.5.0. The clean exact source checkout was verified at that commit; the seven scoped 2.4.1→2.5.0 diffs are retained under `.claude/kimi-code-research/daily-monitor/2026-11-05-2.5.0-diffs/`.
+
+## Source and integration review
+
+Four independent source lanes reviewed hooks/plan, CLI/bootstrap, tools/fan-out, and activation adversarially. The hook/plan lane returned COMPAT-PRESERVED. Other lanes identified the removed status route, remote execution defaults/bindings, and the workspace-trust bypass; those findings drove fail-closed repairs rather than certification by assertion. A separate runtime diff review returned APPROVE with no correctness defects.
+
+- The expanded exact-tag scan passed **18 tests and 153 assertions across 40 pinned files**, including the SDK, remote-environment implementation, workspace trust/MCP, upgrade authentication, and WebSocket state surfaces. The sole final allow remains active-plan-gated, every model tool execution retains the managed before-execute path, and EnterPlanMode remains removed.
+- Exact 2.5.0 activation uses authenticated protocol-v2 WebSocket main-agent state with unique request IDs, an accepted subscription, and the latest frame through intentional bounded close. Earlier certified versions retain `/status`. Focused activation passed **67 tests with 228 assertions**, including wrong identities, request IDs, optional fields, malformed/oversized frames, contradictory state, timeouts, and local-binding failures.
+- Fresh 2.5.0 print selects `--environment local`; resume never receives that flag. Launcher environment selectors are refused. Remote defaults and disabled workspace trust refuse before spawn. Resume inspection covers persisted metadata and every agent journal, requiring local execution and the expected root, including omitted-metadata-`environmentId` and swarm-write worktrees. Activation and deactivation independently re-read the authenticated local binding before either profile mutation.
+
+## Exact-binary controls
+
+Controls used a task-authorized Agent Key in process memory/environment and empty isolated homes, except the forced removed-tool control, which used a loopback scripted provider and a dummy key. No personal config or OAuth store was read, copied, or symlinked. Controls ran sequentially; completed evidence homes had credential-bearing config removed afterward. Raw evidence is under `.claude/kimi-code-research/cert-2.5.0-live/`.
+
+- **Plan OFF Write:** the exact 2.5.0 marker was first; Write reached the custom deny-all control hook and was denied on the same call ID. No target file or plan state was created.
+- **Plan ON:** authenticated agent state independently proved `plan_mode:true`, auto permission, and the env-model alias before resume. Glob reached the deny hook; a **1,459-byte** plan file was written without a plan-Write hook invocation. The workspace remained empty.
+- **Removed EnterPlanMode:** the offered tools included Write but not EnterPlanMode. A scripted provider forced `call_enter_forced`; the exact binary returned `Tool "EnterPlanMode" not found` on that ID before any hook call and returned the rejection to the provider. No plan state or files appeared.
+- **Environment:** real activation and deactivation passed with the explicit local binding. A configured remote default refused before its command launcher ran, disabled workspace trust refused before spawn, and a resumed remote binding refused before spawn. The implementation also passes focused omitted-id and wrong-root checks.
+- **Swarm OFF:** a real AgentSwarm call returned the inactive-mode result with zero child journals and no probe files.
+- **Swarm ON:** preactivation produced `agent-0` and `agent-1`; each child attempted its assigned Write with a matching managed-denial result under the same toolCallId. No probes landed, and deactivation verified `swarm_mode.exit` with the idle-reclaimer override.
+- **Out-of-root control:** an evidence-preserving run correlated two distinct child Writes with rescue denials on their assigned call IDs, created no files, and verified deactivation.
+
+## Candidate and production matrices
+
+- Expanded candidate matrix (`candidate-smoke-final.log`): **24 pass, 0 fail, 167 assertions, no skips**, 396.89 seconds. Real `runRescue` landed the confined sentinel and persisted operation/version/engine/session/artifact evidence. The absolute out-of-root Bash.cwd call received its exact same-call denial and created no file. Write-swarm produced a 278-byte child-authored patch, left the user tree clean, removed its worktree, and denied the out-of-root write.
+- Expanded production-table matrix (`production-smoke.log`) with the candidate override explicitly unset: **24 pass, 0 fail, 167 assertions, no skips**, 326.30 seconds. The same confinement, provenance, resume, pursuit, fan-out, patch, and negative-write checks passed.
+- Candidate and production goal controls produced same-call managed denials across distinct turns and left the workspace empty at settlement.
+- The earlier candidate attempt passed 23 of 24 lanes but was rejected as incomplete. The fresh final candidate run above supersedes it. Invalid diagnostic fixtures using relative or symlink-alias cwd were also rejected as control evidence, not counted as product failures.
+
+## Repository and package gates
+
+Frozen dependency installation made no changes. The literal standard `bun run check` passed **1,404 tests with 33 expected opt-in skips, 0 failures, and 17,999 assertions across 82 files in 336.44 seconds**, including the generated-distribution drift gate. Package validation passed **329 files**, all three compiled distributions, isolated hook setup/check and version refusal, a patched DSH host/profile with seven live providers/tools, and Web boot. An isolated npm consumer-security audit also passed. The certification record is included in the archive. Independent documentation fidelity review identified nine documentation corrections and, after verifying the corrected files, returned **APPROVE** with no remaining must-fix findings. The fresh tag-scan log is retained at `.claude/kimi-code-research/cert-2.5.0-live/tag-scan-final.log`.
+
+## Preserved boundaries
+
+Certification remains exact and per-operation. Legacy-v1 ends at 0.41.x. Plan mode and unsafe experimental selectors remain refused. Local execution and workspace trust are mandatory, and resumed nonlocal or wrong-root bindings fail closed. Hook verification, trusted-root confinement, concurrency/defaults, one print runner, memory-only web tokens, finite budgets, process/session identity checks, deactivation, and recovery ownership are preserved. Existing Git trust and hook-process failure residuals remain documented; this release does not make the hook an OS sandbox. Publication does not install or re-pin either host.
+
+## Release clean-close hardening
+
+After the original certification, Linux release CI exposed a platform-specific early WebSocket close event that could be accepted as valid final agent state. The final runtime now requires `CloseEvent.wasClean` before accepting that state, and the mock performs a protocol-correct close handshake while retaining the timeout case. Focused activation validation passed **71 tests with 244 assertions**. On the exact 2.5.0 binary, direct OFF again produced no children, preactivated ON produced two children with correlated managed denials and verified deactivation, and the out-of-root control passed. The final full repository check passed **1,412 tests with 18,282 assertions and zero failures in 378.11 seconds**; 330-file package validation and isolated consumer security also passed. These results supplement the original certification evidence and cover the final release behavior.
+
+A subsequent CI attempt showed that native WebSocket close scheduling and `wasClean` semantics vary by platform and cannot supply a deterministic no-close-event precondition. That timeout case now uses a controlled socket which completes the protocol exchange but never emits `close`, and asserts the exact `Kimi web agent-state verification timed out.` message. The refusal is therefore tested without relying on incidental host close timing; production behavior is unchanged by this test-only follow-up.

package/docs/upstream-2.5.1-certification.md

@@ -0,0 +1,43 @@
+# Kimi Code 2.5.1 certification evidence — 2026-11-06
+
+## Status and exact source
+
+**Exact CLI 2.5.1 is certified for all eight operations by the plugin 2.5.2 working tree.** The exact-source audit, non-vacuous plan/environment/swarm controls, candidate matrix, production-table matrix, frozen-install, literal full repository check, package validation, and isolated consumer-security audit passed. Independent read-only `claude -p` review returned **APPROVE with no must-fix findings**. Commit, push, tag, publication, installed-host rollout, and operator CLI pin changes are outside this certification slice and were not performed.
+
+Candidate: `@moonshot-ai/kimi-code@2.5.1`, release commit `1b02030d8c2c6b00131b23ebb67a231614877827`, compared with certified 2.5.0 (`41c341434ae24e45bfe0f2232ec11b80531ac717`). The monitor recorded npm publication at 2026-11-05T09:58:53.967Z. A temporary isolated npm installation and its executable both report 2.5.1; its `dist/main.mjs` SHA-256 is `84156e7a0f500bb58f9734be57b26756c27eacefb9d884ef94db3af0d6b609dc`. The clean exact source checkout was verified at the release commit. The seven scoped 2.5.0→2.5.1 diffs are retained under `.claude/kimi-code-research/daily-monitor/2026-11-06-2.5.1-diffs/`.
+
+## Source and integration review
+
+- Scopes 01–06 are unchanged: print/CLI, before-execute and permission gates, external hooks, plan/restore, bootstrap/config/workspace, tools/fan-out/SDK. Scope 07 changes session-list visibility and web media projection only. The provider protocol omits empty system content on tool-bearing messages; the additional transcript change folds daemon media into web history. Neither changes headless stream records, execution, plan arming, hook ordering, environment binding, or WebSocket agent state.
+- DI/scope creation, OS backends, session reload, wire restore/migrations, and the other human-review scopes are unchanged. Of the 40 pinned files, 39 are byte-identical to 2.5.0. Only `kap-server/src/routes/sessions.ts` changed, for deleted-workspace filtering in session lists; session creation and activation are unchanged.
+- The expanded exact-tag scan passed **18 tests and 153 assertions**, with the print, environment/workspace-trust, and WebSocket checks actually executing on 2.5.1. The preserved 2.5.0 source scan also passed again with the same counts.
+- Reviewed candidate branches cover fresh `--environment local`, exact hook-schema acceptance, preactivation, explicit local binding, and authenticated protocol-v2 WebSocket state. After the production row was added, focused activation/engine/CLI/setup tests passed **296 tests with 3,617 assertions**; preflight and launcher tests separately passed **79 tests with 186 assertions**. Typecheck, build, and generated-surface regeneration passed.
+
+## Exact-binary controls
+
+Controls used a task-authorized Agent Key resolved only into each process and empty absolute-path isolated homes, except the forced removed-tool control, which used a loopback scripted provider and a dummy key. No personal config or OAuth store was read, copied, or symlinked. Controls ran sequentially. Credential-bearing config was removed after the evidence runs. Raw evidence is under `.claude/kimi-code-research/cert-2.5.1-live/`.
+
+- **Plan OFF Write:** the exact 2.5.1 marker was first; Write reached the custom deny-all hook and was denied on the same call ID. No target file or plan state was created.
+- **Plan ON:** authenticated agent state independently proved `plan_mode:true`, auto permission, and the env-model alias before resume. Glob reached the deny hook; a **2,232-byte** plan file was written without a plan-Write hook invocation. The workspace remained empty.
+- **Removed EnterPlanMode:** Write was offered but EnterPlanMode was absent. A scripted provider forced `call_enter_forced`; the exact binary returned `Tool "EnterPlanMode" not found` on that ID before any hook call and returned the rejection to the provider. No plan state or files appeared.
+- **Environment:** real activation and deactivation passed with the explicit local binding. A configured remote default refused before its command launcher ran, disabled workspace trust refused before spawn, and a resumed remote binding refused before spawn.
+- **Swarm OFF:** a real AgentSwarm call returned the inactive-mode result with zero child journals and no probe files.
+- **Swarm ON:** preactivation produced `agent-0` and `agent-1`; each child attempted its assigned Write with a matching managed-denial result under the same toolCallId. No probes landed, and deactivation verified `swarm_mode.exit` with ambient idle reclamation set to 1 ms.
+- **Out-of-root control:** two distinct child Writes were correlated with rescue denials on their assigned call IDs, created no files, and verified deactivation.
+- An initial diagnostic Write attempt used a relative artifact root, causing the spawned CLI to resolve a different home without the control hook. Its Write landed only inside that disposable fixture. The run was rejected as control evidence and superseded by the valid absolute-path plan-OFF run above; it is not counted as a product failure or a hook bypass.
+
+## Candidate matrix
+
+The candidate matrix (`candidate-smoke.log`) passed **24 tests with 167 assertions and no skips in 358.88 seconds**. Real `runRescue` landed the confined sentinel and persisted operation/version/engine/session/artifact evidence. The absolute out-of-root Bash.cwd call received its exact same-call denial and created no file. Resume and plan-taint refusal passed. Thirteen goal turns each had a matching managed Write denial. Both pursue terminal outcomes passed. Write-swarm produced a **278-byte** child-authored patch, left the user tree clean, removed its worktree, and denied the out-of-root write.
+
+## Production matrix and final gates
+
+The production-table matrix (`production-smoke.log`) with the candidate override explicitly unset passed **24 tests with 167 assertions and no skips in 364.25 seconds**. It independently repeated the confined rescue and Bash.cwd evidence, resume/taint refusal, both pursue outcomes, both swarm modes, and out-of-root denial. Eleven goal turns each had a matching managed Write denial, and write-swarm again captured a **278-byte** child-authored patch with a clean user tree and removed worktree.
+
+Frozen dependency installation checked 43 installs across 88 packages and made no changes. The literal standard `bun run check` passed **1,412 tests with 33 expected opt-in skips, 0 failures, and 18,282 assertions across 82 files in 362.99 seconds**, including the generated-distribution drift gate. Package validation passed **330 files**, all three compiled distributions, isolated hook setup/check and version refusal, a patched DSH host/profile with seven live providers/tools, and Web boot. The isolated npm consumer-security audit also passed. An independent read-only `claude -p` review returned **APPROVE with no must-fix findings** after inspecting the runtime, tests, documentation, diffs, and raw control artifacts. Its remaining notes were non-load-bearing evidence-retention limitations. Supporting logs are retained under `.claude/kimi-code-research/cert-2.5.1-live/`, including `check-standard.log`, `package-standard.log`, `consumer-security.log`, `claude-review.log`, `tag-scan-2.5.0-regression.log`, and `binary-sha256.txt`.
+
+## Release clean-close hardening
+
+After the original certification and independent review, Linux release CI exposed a platform-specific early WebSocket close event that could be accepted as valid final agent state. The final runtime now requires `CloseEvent.wasClean` before accepting that state, and the mock performs a protocol-correct close handshake while retaining the timeout case. Focused activation validation passed **71 tests with 244 assertions**. The full 2.5.1 production matrix was rerun against the final implementation and again passed **24 tests with 167 assertions and no skips**, this time in **336.76 seconds**, including nine denied goal turns and a 278-byte child-authored patch. Exact 2.5.0 swarm OFF/ON and out-of-root controls also passed. The final full repository check passed **1,412 tests with 18,282 assertions and zero failures in 378.11 seconds**; 330-file package validation and isolated consumer security also passed. These results supplement the original certification and review evidence and cover the final release behavior.
+
+A subsequent CI attempt showed that native WebSocket close scheduling and `wasClean` semantics vary by platform and cannot supply a deterministic no-close-event precondition. That timeout case now uses a controlled socket which completes the protocol exchange but never emits `close`, and asserts the exact `Kimi web agent-state verification timed out.` message. The refusal is therefore tested without relying on incidental host close timing; production behavior is unchanged by this test-only follow-up.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
   "main": "dist/dsh/index.js",
@@ -22,6 +22,7 @@
     "test": "bun test",
     "smoke:real": "KIMI_PLUGIN_CC_SMOKE=1 bun test tests/runtime/real-binary-smoke.test.ts --path-ignore-patterns '**/worktrees/**'",
     "check:package": "node scripts/check-package.mjs && node scripts/check-dsh-package.mjs",
+    "check:consumer-security": "node scripts/check-consumer-security.mjs",
     "check:contracts": "node scripts/check-contract-size.mjs"
   },
   "devDependencies": {
@@ -31,16 +32,17 @@
     "@deepseek-ai/dsh-session": "0.2.1-rc.5",
     "@deepseek-ai/dsh-subagent": "0.2.1-rc.5",
     "@deepseek-ai/dsh-subprocess": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
     "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5",
-    "@types/bun": "^1.4.2",
-    "@types/node": "^26.5.1",
+    "@types/bun": "^1.4.4",
+    "@types/node": "^26.6.6",
     "smol-toml": "1.9.1",
     "tsx": "^4.23.13",
     "typescript": "^7.0.2"
   },
   "dependencies": {
     "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.5",
     "@deepseek-ai/schemastery": "3.18.5"
   },
   "peerDependencies": {
@@ -50,7 +52,38 @@
     "@deepseek-ai/dsh-session": ">=0.2.1-rc.5 <0.3.0",
     "@deepseek-ai/dsh-subagent": ">=0.2.1-rc.5 <0.3.0",
     "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.5 <0.3.0",
-    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0"
+    "@deepseek-ai/dsh-system-prompt": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.5 <0.3.0",
+    "@deepseek-ai/dsh-tool-subagent": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subagent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subprocess": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-system-prompt": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-working-directory": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tool-subagent": {
+      "optional": true
+    }
   },
   "overrides": {
     "zod": "^4.6.6",
@@ -101,6 +134,8 @@
     "docs/models.md",
     "docs/session-visibility.md",
     "docs/upstream-2.4.1-certification.md",
+    "docs/upstream-2.5.0-certification.md",
+    "docs/upstream-2.5.1-certification.md",
     "README.md",
     "LICENSE",
     "CHANGELOG.md",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/cli-client.js

@@ -65,6 +65,7 @@ export async function runCliPrompt(opts) {
             kimiHome: resolveKimiHome(opts.env, opts.cwd),
             env: opts.env,
             resumeSessionId: opts.resumeSessionId,
+            expectedExecutionRoot: opts.trustedWorkspaceRoot ?? opts.cwd,
             stage: "cli-client.spawn",
         });
     }
@@ -781,6 +782,13 @@ const KIMI_LEGACY_FORCED_VALUE = "1";
 function buildArgs(opts) {
     const args = [...(opts.prefixArgs ?? [])];
     args.push("--output-format", "stream-json");
+    const smokeCandidate = opts.executionPlan.certification === "test-bypass" && opts.env.KIMI_PLUGIN_CC_SMOKE === "1"
+        ? opts.env.KIMI_PLUGIN_CC_SMOKE_V2_CANDIDATE
+        : undefined;
+    if (opts.resumeSessionId === undefined &&
+        ["2.5.0", "2.5.1"].includes(opts.executionPlan.kimiVersion ?? smokeCandidate ?? "")) {
+        args.push("--environment", "local");
+    }
     if (opts.resumeSessionId !== undefined) {
         args.push("-r", opts.resumeSessionId);
     }

package/plugins/kimi-codex/dist/commands/setup.js

@@ -9,7 +9,8 @@ import { SETUP_SUPPORTED_FLAGS } from "../parsing.js";
 // absolute Node path avoids PATH dependence under sanitized launches. Setup
 // probes the hook directly with resolveNodeBinary and through `/bin/sh -c`
 // using the exact installed command bytes. It also warns about broad permission
-// denies and refuses duplicate, orphaned, or malformed managed blocks.
+// denies, repairs orphan marker comments, and refuses remaining
+// duplicate, orphaned, or malformed managed blocks.
 //
 // Subcommands: install (default), --check, --uninstall [--all], and
 // --enable-review-gate/--disable-review-gate.
@@ -25,12 +26,13 @@ import { readPluginConfig, writePluginConfig } from "../config.js";
 import { RuntimeError } from "../errors.js";
 import { normalizeTopLevelInlineHooks, validateKimiHookSetForEnvironment, withKimiConfigLock, } from "../hooks/config-safety.js";
 import { buildHookShellCommand, hostIdFromHookCommand, resolveHookScriptPath, resolveHostId, resolveNodeBinary, } from "../hooks/install-paths.js";
-import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
+import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
 import { formatVersionOutOfRangeWarning, probeKimiVersion, } from "../kimi-version-probe.js";
 import { isNativeV2CertifiedVersion } from "../kimi-engine.js";
 import { resolveKimiHome } from "../kimi-home.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
+import { parse as parseToml } from "../vendor/smol-toml/parse.js";
 const BEGIN_MARKER_PREFIX = "# === BEGIN kimi-plugin-cc-managed";
 const DEFAULT_HOOK_TIMEOUT_S = 15;
 // Probe timing. The direct script probe is local and fast; allow 5s for
@@ -119,7 +121,17 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
     const mutation = await withKimiConfigLock(configPath, async () => {
         const original = await readConfigSafe(configPath);
         const lineEnding = detectLineEnding(original);
-        const inlineHooks = normalizeTopLevelInlineHooks(original, lineEnding);
+        try {
+            parseToml(original);
+        }
+        catch {
+            await assertKimiHookSetValid(original, configPath, "setup.install", context.env);
+        }
+        const repaired = removeOrphanMarkers(original);
+        if (repaired.count > 0) {
+            warnings.push(`Removed ${repaired.count} orphaned managed marker comment(s); surrounding config was preserved.`);
+        }
+        const inlineHooks = normalizeTopLevelInlineHooks(repaired.contents, lineEnding);
         if (inlineHooks.found) {
             // Validate before normalizing so an invalid inline entry is reported
             // against the user's original bytes and the config remains untouched.
@@ -133,7 +145,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         // splice line numbers. Another host's marker-less table may be its live hook
         // after a config rewrite strips comments, so it must remain untouched.
         const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, lineEnding, hostId, expectedCommand);
+        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, hostId, expectedCommand);
         const existing = pruned;
         if (prunedCount > 0) {
             const readorned = prunedCommands.includes(expectedCommand);
@@ -145,7 +157,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         if (state.kind === "orphan") {
             throw new RuntimeError("SETUP_ORPHAN_MARKERS", [
                 `kimi-code config at ${configPath} contains an orphaned ${state.detail} marker.`,
-                "Run `/kimi:setup --uninstall` to clean up, then re-run `/kimi:setup`.",
+                "Inspect the managed marker comments and re-run setup.",
             ].join(" "), "setup.install", { details: { configPath, orphan: state.detail } });
         }
         if (state.kind === "duplicate") {
@@ -393,12 +405,11 @@ async function runUninstallLocked(configPath, hookScriptPath, hostId, removeAllH
     // other hosts' blocks and live marker-less tables remain intact. `--all` is
     // the explicit every-host sweep for all of this plugin's hook tables.
     const { stripped: strippedMarkers, removedBlocks, orphansLeft } = stripManagedBlocks(existing, hostId, removeAllHosts);
-    const lineEnding = detectLineEnding(existing);
     // Exact current command bytes also identify this host's table when a host-id
     // override disagrees with path derivation or a dev path is outside the strict
     // ownership pattern.
     const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, lineEnding, removeAllHosts ? undefined : hostId, expectedCommand);
+    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, removeAllHosts ? undefined : hostId, expectedCommand);
     const changed = stripped !== existing;
     if (changed) {
         await writeConfigAtomic(configPath, stripped);
@@ -517,10 +528,10 @@ function detectLineEnding(contents) {
     return contents.includes("\r\n") ? "\r\n" : "\n";
 }
 function spliceBlock(contents, beginLine, endLine, replacement, lineEnding) {
-    const lines = splitPreservingEnding(contents);
-    const before = lines.slice(0, beginLine).join(lineEnding);
-    const after = lines.slice(endLine + 1).join(lineEnding);
-    const beforeWithSep = before.endsWith(lineEnding) || before.length === 0 ? before : `${before}${lineEnding}`;
+    const lines = contents.split(/(?<=\n)/);
+    const before = lines.slice(0, beginLine).join("");
+    const after = lines.slice(endLine + 1).join("");
+    const beforeWithSep = before.endsWith("\n") || before.length === 0 ? before : `${before}${lineEnding}`;
     const replacementWithEnding = replacement.endsWith(lineEnding) ? replacement : `${replacement}${lineEnding}`;
     return `${beforeWithSep}${replacementWithEnding}${after}`;
 }
@@ -536,14 +547,54 @@ function splitPreservingEnding(contents) {
     // pass the desired line ending).
     return contents.split("\n").map((line) => line.replace(/\r$/, ""));
 }
+// A partial upstream hooks-array rewrite can leave one marker comment behind.
+// Remove only unpaired marker comments, never the intervening content. The
+// normal full-file validation still gates writes.
+function removeOrphanMarkers(contents) {
+    const lines = splitPreservingEnding(contents);
+    const orphans = [];
+    const comments = markerCommentLines(contents);
+    let open = null;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
+        const line = lines[i].trim();
+        const begin = MARKERS.BEGIN_LINE_RE.exec(line);
+        if (begin !== null) {
+            if (open !== null)
+                orphans.push(open);
+            open = { index: i, host: begin[1]?.toLowerCase() ?? null };
+        }
+        else {
+            const end = MARKERS.END_LINE_RE.exec(line);
+            if (end === null)
+                continue;
+            const endMarker = { index: i, host: end[1]?.toLowerCase() ?? null };
+            if (open === null)
+                orphans.push(endMarker);
+            else {
+                if (open.host !== endMarker.host)
+                    orphans.push(open, endMarker);
+                open = null;
+            }
+        }
+    }
+    if (open !== null)
+        orphans.push(open);
+    const remove = new Set(orphans.map((marker) => marker.index));
+    return remove.size === 0
+        ? { contents, count: 0 }
+        : { contents: contents.split(/(?<=\n)/).filter((_, index) => !remove.has(index)).join(""), count: remove.size };
+}
 /**
  * Remove managed blocks owned by `currentHost`, or every host with `removeAll`.
  * Ownership comes from the marker suffix or a legacy command's derived host.
  * Orphan markers are removed individually so surrounding user content survives.
  */
 function stripManagedBlocks(contents, currentHost, removeAll) {
-    const lineEnding = detectLineEnding(contents);
     const lines = splitPreservingEnding(contents);
+    const rawLines = contents.split(/(?<=\n)/);
+    const markerLines = markerCommentLines(contents);
     const result = [];
     const orphansLeft = [];
     let removedBlocks = 0;
@@ -567,7 +618,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
     while (i < lines.length) {
         const line = lines[i];
         const trimmed = line.trim();
-        const begin = MARKERS.BEGIN_LINE_RE.exec(trimmed);
+        const begin = markerLines.has(i) ? MARKERS.BEGIN_LINE_RE.exec(trimmed) : null;
         if (begin !== null) {
             const beginHost = begin[1]?.toLowerCase() ?? null;
             // Look ahead for the matching END, capturing the block's command en route.
@@ -575,12 +626,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             let blockCommand = null;
             for (let j = i + 1; j < lines.length; j += 1) {
                 const nextTrimmed = lines[j].trim();
-                if (MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
+                if (markerLines.has(j) && MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
                     // Two BEGINs in a row — the outer one is an orphan.
                     break;
                 }
-                if (MARKERS.END_LINE_RE.test(nextTrimmed)) {
-                    endIdx = j;
+                const end = markerLines.has(j) ? MARKERS.END_LINE_RE.exec(nextTrimmed) : null;
+                if (end !== null) {
+                    if ((end[1]?.toLowerCase() ?? null) === beginHost)
+                        endIdx = j;
                     break;
                 }
                 const decoded = decodeManagedCommandLine(nextTrimmed);
@@ -594,7 +647,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                     i += 1;
                     continue;
                 }
-                result.push(line);
+                result.push(rawLines[i]);
                 i += 1;
                 continue;
             }
@@ -606,11 +659,11 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             }
             // Another host's block — keep it verbatim.
             for (let k = i; k <= endIdx; k += 1)
-                result.push(lines[k]);
+                result.push(rawLines[k]);
             i = endIdx + 1;
             continue;
         }
-        const end = MARKERS.END_LINE_RE.exec(trimmed);
+        const end = markerLines.has(i) ? MARKERS.END_LINE_RE.exec(trimmed) : null;
         if (end !== null) {
             const endHost = end[1]?.toLowerCase() ?? null;
             // Orphan END with no preceding BEGIN: drop only this line (if ours).
@@ -619,27 +672,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                 i += 1;
                 continue;
             }
-            result.push(line);
+            result.push(rawLines[i]);
             i += 1;
             continue;
         }
-        result.push(line);
+        result.push(rawLines[i]);
         i += 1;
     }
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of result) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
-    return { stripped: collapsed.join(lineEnding), removedBlocks, orphansLeft };
+    return { stripped: result.join(""), removedBlocks, orphansLeft };
 }
 /**
  * Remove orphaned, marker-less `[[hooks]]` tables that are unambiguously this
@@ -654,7 +694,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
  * host — REQUIRED for scoped install/uninstall so one host never disarms the
  * other's live (marker-stripped) hook. Omit only for `--uninstall --all`.
  */
-function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchCommand) {
+function pruneOrphanApprovalHooks(contents, ownedBy, alsoMatchCommand) {
     const ranges = findUnmanagedApprovalHookBlocks(contents, ownedBy, alsoMatchCommand);
     if (ranges.length === 0)
         return { pruned: contents, count: 0, commands: [] };
@@ -663,23 +703,10 @@ function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchComman
         for (let i = start; i < end; i += 1)
             remove.add(i);
     }
-    const lines = splitPreservingEnding(contents);
+    const lines = contents.split(/(?<=\n)/);
     const kept = lines.filter((_, idx) => !remove.has(idx));
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of kept) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
     return {
-        pruned: collapsed.join(lineEnding),
+        pruned: kept.join(""),
         count: ranges.length,
         commands: ranges.map((range) => range.command),
     };

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 additionally activate a same-job
-// session through a bounded loopback web lifecycle, then resume it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1 additionally
+// activate a same-job session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/plugins/kimi-codex/dist/dsh/companion.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { brandString } from "@deepseek-ai/dsh-brand";
 import { assertUsableCwd, settleRunResult, subprocessRunHandle, } from "@deepseek-ai/dsh-subagent";
+import { preferStableNodePath } from "../hooks/install-paths.js";
 export const DSH_COMPANION_OPERATIONS = [
     "ask",
     "review",
@@ -20,7 +21,7 @@ export function companionTextTask(prompt) {
     }
     return text;
 }
-export function companionArgv(operation, prompt, companionPath, nodeBin = process.execPath, options = {}) {
+export function companionArgv(operation, prompt, companionPath, nodeBin = preferStableNodePath(process.execPath), options = {}) {
     const command = operation === "ask" || operation === "review"
         ? [operation]
         : operation === "swarm-write"
@@ -41,7 +42,7 @@ export function companionArgv(operation, prompt, companionPath, nodeBin = proces
         prompt,
     ];
 }
-export function companionEnvironment(dataRoot, cwd, env, nodeBin = process.execPath) {
+export function companionEnvironment(dataRoot, cwd, env, nodeBin = preferStableNodePath(process.execPath)) {
     return {
         ...env,
         KIMI_PLUGIN_CC_DATA: dataRoot,
@@ -79,8 +80,9 @@ export async function startCompanionRun(request, operation, spec) {
     request.signal.addEventListener("abort", onAbort, { once: true });
     let child;
     try {
+        const nodeBin = preferStableNodePath(process.execPath);
         child = spec.spawn({
-            argv: companionArgv(operation, prompt, spec.companionPath, process.execPath, spec),
+            argv: companionArgv(operation, prompt, spec.companionPath, nodeBin, spec),
             cwd,
             stdio: {
                 stdin: "ignore",
@@ -89,7 +91,7 @@ export async function startCompanionRun(request, operation, spec) {
             },
             graceMs: spec.disposeGraceMs,
             signal: termination.signal,
-            env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+            env: companionEnvironment(spec.dataRoot, cwd, spec.env, nodeBin),
         });
     }
     catch (error) {
@@ -141,8 +143,9 @@ export async function startCompanionRun(request, operation, spec) {
     });
 }
 export async function runCompanionCommand(argv, cwd, spec, signal) {
+    const nodeBin = preferStableNodePath(process.execPath);
     const child = spec.spawn({
-        argv: [process.execPath, spec.companionPath, ...argv],
+        argv: [nodeBin, spec.companionPath, ...argv],
         cwd,
         stdio: {
             stdin: "ignore",
@@ -151,7 +154,7 @@ export async function runCompanionCommand(argv, cwd, spec, signal) {
         },
         graceMs: spec.disposeGraceMs,
         signal,
-        env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+        env: companionEnvironment(spec.dataRoot, cwd, spec.env, nodeBin),
     });
     try {
         const outcome = await child.done;

package/plugins/kimi-codex/dist/dsh/index.js

@@ -8,6 +8,12 @@ import { DSH_COMPANION_OPERATIONS, runCompanionCommand, startCompanionRun, } fro
 import { parseDurationMs } from "../parsing.js";
 export const name = "kimi-plugin-cc";
 export const inject = ["subagents", "subprocess"];
+export const DSH_TOOL_GUIDANCE = [
+    "Kimi delegation tools have different write boundaries:",
+    "kimi_ask, kimi_review, and kimi_challenge are read-only; kimi_swarm is a read-only parallel review.",
+    "kimi_rescue and kimi_pursue can edit the selected workspace; kimi_pursue continues toward a bounded goal.",
+    "kimi_swarm_write edits a temporary worktree and returns a patch without applying it.",
+].join(" ");
 const DEFAULT_DISPOSE_GRACE_MS = 6_000;
 const DEFAULT_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
@@ -50,8 +56,8 @@ function resolveConfig(config) {
     if (!path.isAbsolute(resolved.dataRoot)) {
         throw new Error("kimi-plugin-cc: dataRoot must be absolute");
     }
-    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs <= 0 || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
-        throw new Error(`kimi-plugin-cc: disposeGraceMs must be positive, finite, and no greater than ${MAX_TIMER_DELAY_MS}`);
+    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs < DEFAULT_DISPOSE_GRACE_MS || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`kimi-plugin-cc: disposeGraceMs must be at least ${DEFAULT_DISPOSE_GRACE_MS} and no greater than ${MAX_TIMER_DELAY_MS}`);
     }
     if (!Number.isSafeInteger(resolved.maxOutputBytes) || resolved.maxOutputBytes <= 0) {
         throw new Error("kimi-plugin-cc: maxOutputBytes must be a positive safe integer");
@@ -105,6 +111,13 @@ export function apply(ctx, config) {
     for (const operation of DSH_COMPANION_OPERATIONS) {
         ctx.subagents.registerProvider(new KimiCompanionProvider(`kimi-${operation}`, operation, spec));
     }
+    ctx.inject(["systemPrompt"], (promptCtx) => {
+        promptCtx.systemPrompt.section({
+            name: "kimi-plugin-cc:tool-boundaries",
+            order: promptCtx.systemPrompt.getSectionOrder("TOOL_SUBAGENT"),
+            text: () => DSH_TOOL_GUIDANCE,
+        });
+    });
     ctx.inject(["commands"], (commandCtx) => {
         const execute = async (invocation, argv) => {
             const directories = commandCtx.get("workingDirectory");