kimi-plugin-cc 2.5.2 → 2.5.3

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, parallel tasks, and MCP tasks through the local Kimi Code CLI.",
-    "version": "2.5.2"
+    "version": "2.5.3"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Kimi for Claude Code: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tasks through the local Kimi Code CLI, with PreToolUse safety hooks.",
-  "version": "2.5.2",
+  "version": "2.5.3",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.5.3 — 2026-11-06
+
+- Certify exact kimi-code 2.5.0 and 2.5.1 for all eight native-v2 operations. Preserve the no-plan construction, local execution and workspace-trust enforcement, authenticated WebSocket swarm state, bounded lifecycle cleanup, and the legacy-v1 0.41.x boundary. See the [2.5.0](docs/upstream-2.5.0-certification.md) and [2.5.1](docs/upstream-2.5.1-certification.md) evidence.
+- Review every exact-version branch for fresh `--environment local`, hook schemas, preactivation, local environment/cwd binding, and protocol-v2 agent state. Require a clean WebSocket close before accepting final agent state, preserving timeout and abnormal-close refusals across Bun platforms. The 2.5.1 source scan passed 18 tests with 153 assertions; candidate and production matrices each passed 24 tests with 167 assertions and no skips, including real rescue, Bash.cwd confinement, resume/taint refusal, goal-turn denials, and child-authored patches.
+- Pass the full repository gate with 1,412 tests and 18,282 assertions, 330-file package checks across all three distributions, isolated consumer security, and independent read-only `claude -p` review with no must-fix findings. Update the manual smoke default to exact 2.5.1 and the current compatibility documentation; publication does not update installed hosts or operator pins.
+
 ## 2.5.2 — 2026-11-02
 
 - Preserve TOML multiline values, line endings, and foreign hook fields during setup; repair mixed-host orphan marker comments without altering foreign hooks.

package/dist/cli-client.js

@@ -65,6 +65,7 @@ export async function runCliPrompt(opts) {
             kimiHome: resolveKimiHome(opts.env, opts.cwd),
             env: opts.env,
             resumeSessionId: opts.resumeSessionId,
+            expectedExecutionRoot: opts.trustedWorkspaceRoot ?? opts.cwd,
             stage: "cli-client.spawn",
         });
     }
@@ -781,6 +782,13 @@ const KIMI_LEGACY_FORCED_VALUE = "1";
 function buildArgs(opts) {
     const args = [...(opts.prefixArgs ?? [])];
     args.push("--output-format", "stream-json");
+    const smokeCandidate = opts.executionPlan.certification === "test-bypass" && opts.env.KIMI_PLUGIN_CC_SMOKE === "1"
+        ? opts.env.KIMI_PLUGIN_CC_SMOKE_V2_CANDIDATE
+        : undefined;
+    if (opts.resumeSessionId === undefined &&
+        ["2.5.0", "2.5.1"].includes(opts.executionPlan.kimiVersion ?? smokeCandidate ?? "")) {
+        args.push("--environment", "local");
+    }
     if (opts.resumeSessionId !== undefined) {
         args.push("-r", opts.resumeSessionId);
     }

package/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 additionally activate a same-job
-// session through a bounded loopback web lifecycle, then resume it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1 additionally
+// activate a same-job session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/dist/hooks/config-safety.js

@@ -595,7 +595,8 @@ function validateVersionSensitiveEvents(events, version) {
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
     // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e), 2.3.2 (b8dd3a13), 2.3.3 (ec495f0c),
-    // 2.4.0 (f26e4d91), and 2.4.1 (2c73f3f5): the additive events and HookDefSchema are unchanged.
+    // 2.4.0 (f26e4d91), 2.4.1 (2c73f3f5), 2.5.0 (41c34143), and 2.5.1 (1b02030d):
+    // the additive events and HookDefSchema are unchanged.
     // Require the full version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
@@ -608,7 +609,9 @@ function validateVersionSensitiveEvents(events, version) {
             (version.version === "2.3.2" && version.patch === 2) ||
             (version.version === "2.3.3" && version.patch === 3))) ||
         (version.minor === 4 && ((version.version === "2.4.0" && version.patch === 0) ||
-            (version.version === "2.4.1" && version.patch === 1))))) {
+            (version.version === "2.4.1" && version.patch === 1))) ||
+        (version.minor === 5 && ((version.version === "2.5.0" && version.patch === 0) ||
+            (version.version === "2.5.1" && version.patch === 1))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/dist/kimi-command.js

@@ -47,6 +47,7 @@ const RESERVED_PREFIX_FLAGS = new Set([
     "--plan", "--auto", "-y", "--yolo", "--yes", "--auto-approve", "--manual",
     // Model / profile / roots.
     "-m", "--model", "--skills-dir", "--agent", "--agent-file", "--add-dir",
+    "--environment", "--environment-cwd",
     // Terminal informational flags (would replace the run with a banner).
     "-V", "--version", "-h", "--help",
 ]);

package/dist/kimi-engine.js

@@ -45,6 +45,8 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.3",
     "2.4.0",
     "2.4.1",
+    "2.5.0",
+    "2.5.1",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([
@@ -127,6 +129,7 @@ export async function prepareKimiExecutionPlan(options) {
             kimiHome: resolveKimiHome(options.env, options.cwd),
             env: options.env,
             resumeSessionId: options.resumeSessionId,
+            expectedExecutionRoot: options.cwd,
             stage: "kimi-engine.plan",
         });
     };

package/dist/native-v2-preflight.js

@@ -13,9 +13,10 @@
 //     B. the EnterPlanMode tool (already hook-denied for every label);
 //     C. resuming a session whose agent wire journal holds a durable
 //        `plan_mode.enter` record (restore() folds ONLY agents/*/wire.jsonl).
-//   This module closes A and C before any process is spawned, and refuses the
+//   This module closes A and C before any process is spawned, refuses the
 //   v2-only experimental features (tower, subagent fork) that this plugin does
-//   not certify. B stays in runtime/hooks/approval-policy.ts.
+//   not certify, and requires local execution for configured and resumed sessions.
+//   B stays in runtime/hooks/approval-policy.ts.
 //
 // Contract:
 //   - Pure inspection: never writes, never rewrites operator config, never
@@ -155,6 +156,48 @@ export async function inspectPlanModeConfig(kimiHome) {
         reason: `\`${offending.join("`, `")}\` (upstream setting \`default_plan_mode\`) is set in ${configPath} and is not \`false\`.`,
     };
 }
+export async function inspectEnvironmentConfig(kimiHome) {
+    const parsed = await readParsedConfig(kimiHome);
+    if (parsed.kind === "unreadable") {
+        return { kind: "refuse", refusalKind: "v2-config-unreadable", reason: parsed.reason };
+    }
+    const section = parsed.config?.["environments"];
+    if (section !== undefined) {
+        if (section === null || typeof section !== "object" || Array.isArray(section)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "The [environments] section is not a table, so the execution environment cannot be verified as local.",
+            };
+        }
+        if (section["default"] !== undefined) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "A default remote execution environment is configured in [environments]; plugin-managed jobs require the local environment.",
+            };
+        }
+    }
+    const workspace = parsed.config?.["workspace"];
+    if (workspace !== undefined) {
+        if (workspace === null || typeof workspace !== "object" || Array.isArray(workspace)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "The [workspace] section is not a table, so project trust requirements cannot be verified.",
+            };
+        }
+        const trustDisabled = Object.entries(workspace).some(([key, value]) => upstreamSnakeToCamel(key) === "requireTrust" && value !== true);
+        if (trustDisabled) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "Workspace trust is disabled in [workspace]; plugin-managed jobs require project trust enforcement to remain enabled.",
+            };
+        }
+    }
+    return { kind: "ok" };
+}
 /**
  * Refuse v2-only experimental features this plugin does not certify.
  * Sources (per-flag precedence upstream is env → [experimental] config →
@@ -239,40 +282,39 @@ async function openJournalSafely(journalPath, maxBytes) {
     }
     return { kind: "ok", handle };
 }
-/**
- * Scan one open journal's lines for a plan-mode control record. Returns the
- * record `type` string on a match, "<unparseable>" for a suspicious line
- * that fails to parse, or null when the journal is clean.
- */
-async function scanJournalLines(handle) {
+async function scanJournalLines(handle, expectedExecutionRoot) {
     const rl = createInterface({ input: handle.createReadStream() });
     try {
         for await (const rawLine of rl) {
             const line = rawLine.trim();
             if (line.length === 0)
                 continue;
-            // Parse EVERY record and check its DECODED `type`. A raw-substring filter
-            // is unsafe on its own: a JSON-escaped type such as
-            // {"type":"plan_mode.enter"} contains no literal "plan_mode." yet
-            // upstream JSON.parse decodes it to "plan_mode.enter" and restores active
-            // plan mode. So parse first (this catches the escape). If a line FAILS to
-            // parse, upstream cannot fold it into a plan event either — but be
-            // conservative: a malformed line that still LOOKS plan-related is treated
-            // as tainted rather than skipped, so a hand-corrupted journal cannot hide
-            // a plan record behind a parse error.
             let parsed;
             try {
                 parsed = JSON.parse(line);
             }
             catch {
                 if (line.includes('"plan_mode.') || line.includes('"plan.')) {
-                    return "<unparseable>";
+                    return { kind: "tainted", recordType: "<unparseable>" };
+                }
+                if (line.includes('"environment.set_binding')) {
+                    return { kind: "environment", recordType: "<unparseable-environment-binding>" };
                 }
                 continue;
             }
-            const type = parsed?.["type"];
+            const record = parsed;
+            const type = record?.["type"];
             if (typeof type === "string" && (type.startsWith("plan_mode.") || type.startsWith("plan."))) {
-                return type;
+                return { kind: "tainted", recordType: type };
+            }
+            if (type === "environment.set_binding") {
+                if (record?.["environmentId"] !== "local") {
+                    return { kind: "environment", recordType: type };
+                }
+                const cwd = record?.["cwd"];
+                if (expectedExecutionRoot !== undefined && cwd !== undefined && cwd !== expectedExecutionRoot) {
+                    return { kind: "environment", recordType: "environment.set_binding.cwd" };
+                }
             }
         }
         return null;
@@ -281,16 +323,48 @@ async function scanJournalLines(handle) {
         rl.close();
     }
 }
+async function inspectSessionMetadataEnvironment(statePath, expectedExecutionRoot) {
+    const read = await readSmallFileSafe(statePath, CONFIG_MAX_BYTES);
+    if (read.kind === "absent")
+        return null;
+    if (read.kind === "unreadable") {
+        return { kind: "unavailable", reason: `${statePath}: ${read.reason}` };
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(read.contents);
+    }
+    catch {
+        return { kind: "unavailable", reason: `${statePath}: malformed session metadata` };
+    }
+    if (metadata === null || typeof metadata !== "object" || Array.isArray(metadata)) {
+        return { kind: "unavailable", reason: `${statePath}: invalid session metadata` };
+    }
+    const record = metadata;
+    const environmentId = record["environmentId"];
+    if (environmentId !== undefined && environmentId !== "local") {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentId" };
+    }
+    const environmentCwd = record["environmentCwd"];
+    if ((environmentId === undefined || environmentId === "local") &&
+        expectedExecutionRoot !== undefined &&
+        environmentCwd !== undefined &&
+        environmentCwd !== expectedExecutionRoot) {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentCwd" };
+    }
+    return null;
+}
 /**
- * Scan every agent wire journal of a saved session for plan-mode records.
- * Layout at 0.42.0: `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
+ * Scan saved session metadata and every agent wire journal for plan-mode records
+ * and nonlocal environment bindings. Layout at 0.42.0:
+ * `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
  * (workspaceId is unknown to the plugin → enumerate `sessions/*` with bounded
  * readdir). Raw-line scan of EVERY agent journal: a JSON line whose `type`
- * starts with `plan_mode.` or `plan.` → tainted (fail-closed on a line that
- * looks suspicious but does not parse). No session dir, no journal, unreadable,
+ * starts with `plan_mode.` or `plan.` → tainted; `environment.set_binding` must
+ * name `environmentId:"local"`. No session dir, no journal, unreadable metadata,
  * or any single journal above the size cap → unavailable. Never modifies files.
  */
-export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
+export async function scanSessionJournalsForPlan(kimiHome, sessionId, expectedExecutionRoot) {
     const sessionsDir = path.join(kimiHome, "sessions");
     const workspaceEntries = await boundedReaddir(sessionsDir, DIR_ENUM_CAP);
     if (workspaceEntries.kind === "absent") {
@@ -316,7 +390,11 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
         }
         if (!workspaceEntry.isDirectory())
             continue;
-        const agentsDir = path.join(sessionsDir, workspaceEntry.name, sessionId, "agents");
+        const sessionDir = path.join(sessionsDir, workspaceEntry.name, sessionId);
+        const metadataFinding = await inspectSessionMetadataEnvironment(path.join(sessionDir, "state.json"), expectedExecutionRoot);
+        if (metadataFinding !== null)
+            return metadataFinding;
+        const agentsDir = path.join(sessionDir, "agents");
         const agentEntries = await boundedReaddir(agentsDir, DIR_ENUM_CAP);
         if (agentEntries.kind === "absent")
             continue;
@@ -347,9 +425,12 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
             return { kind: "unavailable", reason: `${journalPath}: ${opened.reason}` };
         }
         try {
-            const taintedType = await scanJournalLines(opened.handle);
-            if (taintedType !== null) {
-                return { kind: "tainted", journal: journalPath, recordType: taintedType };
+            const finding = await scanJournalLines(opened.handle, expectedExecutionRoot);
+            if (finding?.kind === "tainted") {
+                return { kind: "tainted", journal: journalPath, recordType: finding.recordType };
+            }
+            if (finding?.kind === "environment") {
+                return { kind: "environment", journal: journalPath, recordType: finding.recordType };
             }
         }
         finally {
@@ -363,6 +444,8 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
  *   CLI_V2_PLAN_MODE_CONFIGURED   details.refusal_kind = "v2-plan-mode-configured"
  *   CLI_V2_CONFIG_UNREADABLE      details.refusal_kind = "v2-config-unreadable"
  *   CLI_V2_EXPERIMENTAL_UNSAFE    details.refusal_kind = "v2-experimental-unsafe", details.selectors
+ *   CLI_V2_ENVIRONMENT_UNSAFE / CLI_V2_WORKSPACE_TRUST_UNSAFE for unsafe config
+ *   KIMI_SESSION_ENVIRONMENT_UNSAFE details.refusal_kind = "session-environment-unsafe"
  *   KIMI_SESSION_PLAN_TAINTED     details.refusal_kind = "session-plan-tainted", details.record_type
  *   KIMI_SESSION_JOURNAL_UNAVAILABLE details.refusal_kind = "session-journal-unavailable"
  * Every message carries a truthful remedy (edit the named setting / start a
@@ -384,6 +467,22 @@ export async function assertNativeV2Preflight(options) {
             details: { refusal_kind: planMode.refusalKind, retryable_after_setup: false },
         });
     }
+    const environment = await inspectEnvironmentConfig(options.kimiHome);
+    if (environment.kind === "refuse") {
+        const code = environment.refusalKind === "v2-environment-configured"
+            ? "CLI_V2_ENVIRONMENT_UNSAFE"
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? "CLI_V2_WORKSPACE_TRUST_UNSAFE"
+                : "CLI_V2_CONFIG_UNREADABLE";
+        const remedy = environment.refusalKind === "v2-environment-configured"
+            ? `Remove \`environments.default\` in ${configPath} so plugin-managed sessions stay local.`
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? `Set \`workspace.require_trust = true\` (or remove it) in ${configPath}.`
+                : `Fix or remove the unreadable file at ${configPath} so the execution environment can be verified as local.`;
+        throw new RuntimeError(code, `${environment.reason} ${remedy}`, stage, {
+            details: { refusal_kind: environment.refusalKind, retryable_after_setup: false },
+        });
+    }
     const experimental = await inspectExperimentalSelectors(options.kimiHome, options.env);
     if (experimental.kind === "refuse") {
         throw new RuntimeError("CLI_V2_EXPERIMENTAL_UNSAFE", `${experimental.reason} Unset the listed selector(s) before retrying.`, stage, {
@@ -395,7 +494,16 @@ export async function assertNativeV2Preflight(options) {
         });
     }
     if (options.resumeSessionId !== undefined) {
-        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId);
+        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId, options.expectedExecutionRoot);
+        if (journalScan.kind === "environment") {
+            throw new RuntimeError("KIMI_SESSION_ENVIRONMENT_UNSAFE", `Saved session ${options.resumeSessionId} has an unsafe execution environment binding (${journalScan.recordType} in ${journalScan.journal}). Start a fresh local session; saved session state was not modified.`, stage, {
+                details: {
+                    refusal_kind: "session-environment-unsafe",
+                    record_type: journalScan.recordType,
+                    retryable_after_setup: false,
+                },
+            });
+        }
         if (journalScan.kind === "tainted") {
             throw new RuntimeError("KIMI_SESSION_PLAN_TAINTED", `Saved session ${options.resumeSessionId} previously entered plan mode (record type "${journalScan.recordType}" in ${journalScan.journal}). Start a fresh session; saved session state was not modified.`, stage, {
                 details: {