kimi-plugin-cc 2.5.2 → 2.5.4

package/docs/upstream-2.5.1-certification.md

@@ -0,0 +1,45 @@
+# Kimi Code 2.5.1 certification evidence — 2026-11-06
+
+## Status and exact source
+
+**Exact CLI 2.5.1 is certified for all eight operations by the plugin 2.5.2 working tree.** The exact-source audit, non-vacuous plan/environment/swarm controls, candidate matrix, production-table matrix, frozen-install, literal full repository check, package validation, and isolated consumer-security audit passed. Independent read-only `claude -p` review returned **APPROVE with no must-fix findings**. Commit, push, tag, publication, installed-host rollout, and operator CLI pin changes are outside this certification slice and were not performed.
+
+Candidate: `@moonshot-ai/kimi-code@2.5.1`, release commit `1b02030d8c2c6b00131b23ebb67a231614877827`, compared with certified 2.5.0 (`41c341434ae24e45bfe0f2232ec11b80531ac717`). The monitor recorded npm publication at 2026-11-05T09:58:53.967Z. A temporary isolated npm installation and its executable both report 2.5.1; its `dist/main.mjs` SHA-256 is `84156e7a0f500bb58f9734be57b26756c27eacefb9d884ef94db3af0d6b609dc`. The clean exact source checkout was verified at the release commit. The seven scoped 2.5.0→2.5.1 diffs are retained under `.claude/kimi-code-research/daily-monitor/2026-11-06-2.5.1-diffs/`.
+
+## Source and integration review
+
+- Scopes 01–06 are unchanged: print/CLI, before-execute and permission gates, external hooks, plan/restore, bootstrap/config/workspace, tools/fan-out/SDK. Scope 07 changes session-list visibility and web media projection only. The provider protocol omits empty system content on tool-bearing messages; the additional transcript change folds daemon media into web history. Neither changes headless stream records, execution, plan arming, hook ordering, environment binding, or WebSocket agent state.
+- DI/scope creation, OS backends, session reload, wire restore/migrations, and the other human-review scopes are unchanged. Of the 40 pinned files, 39 are byte-identical to 2.5.0. Only `kap-server/src/routes/sessions.ts` changed, for deleted-workspace filtering in session lists; session creation and activation are unchanged.
+- The expanded exact-tag scan passed **18 tests and 153 assertions**, with the print, environment/workspace-trust, and WebSocket checks actually executing on 2.5.1. The preserved 2.5.0 source scan also passed again with the same counts.
+- Reviewed candidate branches cover fresh `--environment local`, exact hook-schema acceptance, preactivation, explicit local binding, and authenticated protocol-v2 WebSocket state. After the production row was added, focused activation/engine/CLI/setup tests passed **296 tests with 3,617 assertions**; preflight and launcher tests separately passed **79 tests with 186 assertions**. Typecheck, build, and generated-surface regeneration passed.
+
+## Exact-binary controls
+
+Controls used a task-authorized Agent Key resolved only into each process and empty absolute-path isolated homes, except the forced removed-tool control, which used a loopback scripted provider and a dummy key. No personal config or OAuth store was read, copied, or symlinked. Controls ran sequentially. Credential-bearing config was removed after the evidence runs. Raw evidence is under `.claude/kimi-code-research/cert-2.5.1-live/`.
+
+- **Plan OFF Write:** the exact 2.5.1 marker was first; Write reached the custom deny-all hook and was denied on the same call ID. No target file or plan state was created.
+- **Plan ON:** authenticated agent state independently proved `plan_mode:true`, auto permission, and the env-model alias before resume. Glob reached the deny hook; a **2,232-byte** plan file was written without a plan-Write hook invocation. The workspace remained empty.
+- **Removed EnterPlanMode:** Write was offered but EnterPlanMode was absent. A scripted provider forced `call_enter_forced`; the exact binary returned `Tool "EnterPlanMode" not found` on that ID before any hook call and returned the rejection to the provider. No plan state or files appeared.
+- **Environment:** real activation and deactivation passed with the explicit local binding. A configured remote default refused before its command launcher ran, disabled workspace trust refused before spawn, and a resumed remote binding refused before spawn.
+- **Swarm OFF:** a real AgentSwarm call returned the inactive-mode result with zero child journals and no probe files.
+- **Swarm ON:** preactivation produced `agent-0` and `agent-1`; each child attempted its assigned Write with a matching managed-denial result under the same toolCallId. No probes landed, and deactivation verified `swarm_mode.exit` with ambient idle reclamation set to 1 ms.
+- **Out-of-root control:** two distinct child Writes were correlated with rescue denials on their assigned call IDs, created no files, and verified deactivation.
+- An initial diagnostic Write attempt used a relative artifact root, causing the spawned CLI to resolve a different home without the control hook. Its Write landed only inside that disposable fixture. The run was rejected as control evidence and superseded by the valid absolute-path plan-OFF run above; it is not counted as a product failure or a hook bypass.
+
+## Candidate matrix
+
+The candidate matrix (`candidate-smoke.log`) passed **24 tests with 167 assertions and no skips in 358.88 seconds**. Real `runRescue` landed the confined sentinel and persisted operation/version/engine/session/artifact evidence. The absolute out-of-root Bash.cwd call received its exact same-call denial and created no file. Resume and plan-taint refusal passed. Thirteen goal turns each had a matching managed Write denial. Both pursue terminal outcomes passed. Write-swarm produced a **278-byte** child-authored patch, left the user tree clean, removed its worktree, and denied the out-of-root write.
+
+## Production matrix and final gates
+
+The production-table matrix (`production-smoke.log`) with the candidate override explicitly unset passed **24 tests with 167 assertions and no skips in 364.25 seconds**. It independently repeated the confined rescue and Bash.cwd evidence, resume/taint refusal, both pursue outcomes, both swarm modes, and out-of-root denial. Eleven goal turns each had a matching managed Write denial, and write-swarm again captured a **278-byte** child-authored patch with a clean user tree and removed worktree.
+
+Frozen dependency installation checked 43 installs across 88 packages and made no changes. The literal standard `bun run check` passed **1,412 tests with 33 expected opt-in skips, 0 failures, and 18,282 assertions across 82 files in 362.99 seconds**, including the generated-distribution drift gate. Package validation passed **330 files**, all three compiled distributions, isolated hook setup/check and version refusal, a patched DSH host/profile with seven live providers/tools, and Web boot. The isolated npm consumer-security audit also passed. An independent read-only `claude -p` review returned **APPROVE with no must-fix findings** after inspecting the runtime, tests, documentation, diffs, and raw control artifacts. Its remaining notes were non-load-bearing evidence-retention limitations. Supporting logs are retained under `.claude/kimi-code-research/cert-2.5.1-live/`, including `check-standard.log`, `package-standard.log`, `consumer-security.log`, `claude-review.log`, `tag-scan-2.5.0-regression.log`, and `binary-sha256.txt`.
+
+## Release clean-close hardening
+
+After the original certification and independent review, Linux release CI exposed a platform-specific early WebSocket close event that could be accepted as valid final agent state. The final runtime now requires `CloseEvent.wasClean` before accepting that state, and the mock performs a protocol-correct close handshake while retaining the timeout case. Focused activation validation passed **71 tests with 244 assertions**. The full 2.5.1 production matrix was rerun against the final implementation and again passed **24 tests with 167 assertions and no skips**, this time in **336.76 seconds**, including nine denied goal turns and a 278-byte child-authored patch. Exact 2.5.0 swarm OFF/ON and out-of-root controls also passed. The final full repository check passed **1,412 tests with 18,282 assertions and zero failures in 360.79 seconds**; 330-file package validation and isolated consumer security also passed. These results supplement the original certification and review evidence and cover the final release behavior.
+
+A subsequent CI attempt showed that native WebSocket close scheduling and `wasClean` semantics vary by platform and cannot supply a deterministic no-close-event precondition. That timeout case now uses a controlled socket which completes the protocol exchange but never emits `close`, and asserts the exact `Kimi web agent-state verification timed out.` message. The refusal is therefore tested without relying on incidental host close timing; production behavior is unchanged by this test-only follow-up.
+
+**Follow-up correction:** a later normal activation/deactivation fixture showed that `wasClean` can also reject a valid close. The production condition has been reverted on `main`, restoring the original certified bounded-close settlement; the controlled no-close-event test and protocol-correct mock handshake remain. The immutable 2.5.3 artifact contains the trial condition, so carrying this revert requires a new patch artifact rather than a re-tag or republish.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
   "main": "dist/dsh/index.js",
@@ -134,6 +134,8 @@
     "docs/models.md",
     "docs/session-visibility.md",
     "docs/upstream-2.4.1-certification.md",
+    "docs/upstream-2.5.0-certification.md",
+    "docs/upstream-2.5.1-certification.md",
     "README.md",
     "LICENSE",
     "CHANGELOG.md",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/cli-client.js

@@ -65,6 +65,7 @@ export async function runCliPrompt(opts) {
             kimiHome: resolveKimiHome(opts.env, opts.cwd),
             env: opts.env,
             resumeSessionId: opts.resumeSessionId,
+            expectedExecutionRoot: opts.trustedWorkspaceRoot ?? opts.cwd,
             stage: "cli-client.spawn",
         });
     }
@@ -781,6 +782,13 @@ const KIMI_LEGACY_FORCED_VALUE = "1";
 function buildArgs(opts) {
     const args = [...(opts.prefixArgs ?? [])];
     args.push("--output-format", "stream-json");
+    const smokeCandidate = opts.executionPlan.certification === "test-bypass" && opts.env.KIMI_PLUGIN_CC_SMOKE === "1"
+        ? opts.env.KIMI_PLUGIN_CC_SMOKE_V2_CANDIDATE
+        : undefined;
+    if (opts.resumeSessionId === undefined &&
+        ["2.5.0", "2.5.1"].includes(opts.executionPlan.kimiVersion ?? smokeCandidate ?? "")) {
+        args.push("--environment", "local");
+    }
     if (opts.resumeSessionId !== undefined) {
         args.push("-r", opts.resumeSessionId);
     }

package/plugins/kimi-codex/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 additionally activate a same-job
-// session through a bounded loopback web lifecycle, then resume it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1 additionally
+// activate a same-job session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/plugins/kimi-codex/dist/hooks/config-safety.js

@@ -595,7 +595,8 @@ function validateVersionSensitiveEvents(events, version) {
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
     // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e), 2.3.2 (b8dd3a13), 2.3.3 (ec495f0c),
-    // 2.4.0 (f26e4d91), and 2.4.1 (2c73f3f5): the additive events and HookDefSchema are unchanged.
+    // 2.4.0 (f26e4d91), 2.4.1 (2c73f3f5), 2.5.0 (41c34143), and 2.5.1 (1b02030d):
+    // the additive events and HookDefSchema are unchanged.
     // Require the full version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
@@ -608,7 +609,9 @@ function validateVersionSensitiveEvents(events, version) {
             (version.version === "2.3.2" && version.patch === 2) ||
             (version.version === "2.3.3" && version.patch === 3))) ||
         (version.minor === 4 && ((version.version === "2.4.0" && version.patch === 0) ||
-            (version.version === "2.4.1" && version.patch === 1))))) {
+            (version.version === "2.4.1" && version.patch === 1))) ||
+        (version.minor === 5 && ((version.version === "2.5.0" && version.patch === 0) ||
+            (version.version === "2.5.1" && version.patch === 1))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/plugins/kimi-codex/dist/kimi-command.js

@@ -47,6 +47,7 @@ const RESERVED_PREFIX_FLAGS = new Set([
     "--plan", "--auto", "-y", "--yolo", "--yes", "--auto-approve", "--manual",
     // Model / profile / roots.
     "-m", "--model", "--skills-dir", "--agent", "--agent-file", "--add-dir",
+    "--environment", "--environment-cwd",
     // Terminal informational flags (would replace the run with a banner).
     "-V", "--version", "-h", "--help",
 ]);

package/plugins/kimi-codex/dist/kimi-engine.js

@@ -45,6 +45,8 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.3",
     "2.4.0",
     "2.4.1",
+    "2.5.0",
+    "2.5.1",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([
@@ -127,6 +129,7 @@ export async function prepareKimiExecutionPlan(options) {
             kimiHome: resolveKimiHome(options.env, options.cwd),
             env: options.env,
             resumeSessionId: options.resumeSessionId,
+            expectedExecutionRoot: options.cwd,
             stage: "kimi-engine.plan",
         });
     };

package/plugins/kimi-codex/dist/native-v2-preflight.js

@@ -13,9 +13,10 @@
 //     B. the EnterPlanMode tool (already hook-denied for every label);
 //     C. resuming a session whose agent wire journal holds a durable
 //        `plan_mode.enter` record (restore() folds ONLY agents/*/wire.jsonl).
-//   This module closes A and C before any process is spawned, and refuses the
+//   This module closes A and C before any process is spawned, refuses the
 //   v2-only experimental features (tower, subagent fork) that this plugin does
-//   not certify. B stays in runtime/hooks/approval-policy.ts.
+//   not certify, and requires local execution for configured and resumed sessions.
+//   B stays in runtime/hooks/approval-policy.ts.
 //
 // Contract:
 //   - Pure inspection: never writes, never rewrites operator config, never
@@ -155,6 +156,48 @@ export async function inspectPlanModeConfig(kimiHome) {
         reason: `\`${offending.join("`, `")}\` (upstream setting \`default_plan_mode\`) is set in ${configPath} and is not \`false\`.`,
     };
 }
+export async function inspectEnvironmentConfig(kimiHome) {
+    const parsed = await readParsedConfig(kimiHome);
+    if (parsed.kind === "unreadable") {
+        return { kind: "refuse", refusalKind: "v2-config-unreadable", reason: parsed.reason };
+    }
+    const section = parsed.config?.["environments"];
+    if (section !== undefined) {
+        if (section === null || typeof section !== "object" || Array.isArray(section)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "The [environments] section is not a table, so the execution environment cannot be verified as local.",
+            };
+        }
+        if (section["default"] !== undefined) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "A default remote execution environment is configured in [environments]; plugin-managed jobs require the local environment.",
+            };
+        }
+    }
+    const workspace = parsed.config?.["workspace"];
+    if (workspace !== undefined) {
+        if (workspace === null || typeof workspace !== "object" || Array.isArray(workspace)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "The [workspace] section is not a table, so project trust requirements cannot be verified.",
+            };
+        }
+        const trustDisabled = Object.entries(workspace).some(([key, value]) => upstreamSnakeToCamel(key) === "requireTrust" && value !== true);
+        if (trustDisabled) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "Workspace trust is disabled in [workspace]; plugin-managed jobs require project trust enforcement to remain enabled.",
+            };
+        }
+    }
+    return { kind: "ok" };
+}
 /**
  * Refuse v2-only experimental features this plugin does not certify.
  * Sources (per-flag precedence upstream is env → [experimental] config →
@@ -239,40 +282,39 @@ async function openJournalSafely(journalPath, maxBytes) {
     }
     return { kind: "ok", handle };
 }
-/**
- * Scan one open journal's lines for a plan-mode control record. Returns the
- * record `type` string on a match, "<unparseable>" for a suspicious line
- * that fails to parse, or null when the journal is clean.
- */
-async function scanJournalLines(handle) {
+async function scanJournalLines(handle, expectedExecutionRoot) {
     const rl = createInterface({ input: handle.createReadStream() });
     try {
         for await (const rawLine of rl) {
             const line = rawLine.trim();
             if (line.length === 0)
                 continue;
-            // Parse EVERY record and check its DECODED `type`. A raw-substring filter
-            // is unsafe on its own: a JSON-escaped type such as
-            // {"type":"plan_mode.enter"} contains no literal "plan_mode." yet
-            // upstream JSON.parse decodes it to "plan_mode.enter" and restores active
-            // plan mode. So parse first (this catches the escape). If a line FAILS to
-            // parse, upstream cannot fold it into a plan event either — but be
-            // conservative: a malformed line that still LOOKS plan-related is treated
-            // as tainted rather than skipped, so a hand-corrupted journal cannot hide
-            // a plan record behind a parse error.
             let parsed;
             try {
                 parsed = JSON.parse(line);
             }
             catch {
                 if (line.includes('"plan_mode.') || line.includes('"plan.')) {
-                    return "<unparseable>";
+                    return { kind: "tainted", recordType: "<unparseable>" };
+                }
+                if (line.includes('"environment.set_binding')) {
+                    return { kind: "environment", recordType: "<unparseable-environment-binding>" };
                 }
                 continue;
             }
-            const type = parsed?.["type"];
+            const record = parsed;
+            const type = record?.["type"];
             if (typeof type === "string" && (type.startsWith("plan_mode.") || type.startsWith("plan."))) {
-                return type;
+                return { kind: "tainted", recordType: type };
+            }
+            if (type === "environment.set_binding") {
+                if (record?.["environmentId"] !== "local") {
+                    return { kind: "environment", recordType: type };
+                }
+                const cwd = record?.["cwd"];
+                if (expectedExecutionRoot !== undefined && cwd !== undefined && cwd !== expectedExecutionRoot) {
+                    return { kind: "environment", recordType: "environment.set_binding.cwd" };
+                }
             }
         }
         return null;
@@ -281,16 +323,48 @@ async function scanJournalLines(handle) {
         rl.close();
     }
 }
+async function inspectSessionMetadataEnvironment(statePath, expectedExecutionRoot) {
+    const read = await readSmallFileSafe(statePath, CONFIG_MAX_BYTES);
+    if (read.kind === "absent")
+        return null;
+    if (read.kind === "unreadable") {
+        return { kind: "unavailable", reason: `${statePath}: ${read.reason}` };
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(read.contents);
+    }
+    catch {
+        return { kind: "unavailable", reason: `${statePath}: malformed session metadata` };
+    }
+    if (metadata === null || typeof metadata !== "object" || Array.isArray(metadata)) {
+        return { kind: "unavailable", reason: `${statePath}: invalid session metadata` };
+    }
+    const record = metadata;
+    const environmentId = record["environmentId"];
+    if (environmentId !== undefined && environmentId !== "local") {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentId" };
+    }
+    const environmentCwd = record["environmentCwd"];
+    if ((environmentId === undefined || environmentId === "local") &&
+        expectedExecutionRoot !== undefined &&
+        environmentCwd !== undefined &&
+        environmentCwd !== expectedExecutionRoot) {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentCwd" };
+    }
+    return null;
+}
 /**
- * Scan every agent wire journal of a saved session for plan-mode records.
- * Layout at 0.42.0: `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
+ * Scan saved session metadata and every agent wire journal for plan-mode records
+ * and nonlocal environment bindings. Layout at 0.42.0:
+ * `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
  * (workspaceId is unknown to the plugin → enumerate `sessions/*` with bounded
  * readdir). Raw-line scan of EVERY agent journal: a JSON line whose `type`
- * starts with `plan_mode.` or `plan.` → tainted (fail-closed on a line that
- * looks suspicious but does not parse). No session dir, no journal, unreadable,
+ * starts with `plan_mode.` or `plan.` → tainted; `environment.set_binding` must
+ * name `environmentId:"local"`. No session dir, no journal, unreadable metadata,
  * or any single journal above the size cap → unavailable. Never modifies files.
  */
-export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
+export async function scanSessionJournalsForPlan(kimiHome, sessionId, expectedExecutionRoot) {
     const sessionsDir = path.join(kimiHome, "sessions");
     const workspaceEntries = await boundedReaddir(sessionsDir, DIR_ENUM_CAP);
     if (workspaceEntries.kind === "absent") {
@@ -316,7 +390,11 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
         }
         if (!workspaceEntry.isDirectory())
             continue;
-        const agentsDir = path.join(sessionsDir, workspaceEntry.name, sessionId, "agents");
+        const sessionDir = path.join(sessionsDir, workspaceEntry.name, sessionId);
+        const metadataFinding = await inspectSessionMetadataEnvironment(path.join(sessionDir, "state.json"), expectedExecutionRoot);
+        if (metadataFinding !== null)
+            return metadataFinding;
+        const agentsDir = path.join(sessionDir, "agents");
         const agentEntries = await boundedReaddir(agentsDir, DIR_ENUM_CAP);
         if (agentEntries.kind === "absent")
             continue;
@@ -347,9 +425,12 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
             return { kind: "unavailable", reason: `${journalPath}: ${opened.reason}` };
         }
         try {
-            const taintedType = await scanJournalLines(opened.handle);
-            if (taintedType !== null) {
-                return { kind: "tainted", journal: journalPath, recordType: taintedType };
+            const finding = await scanJournalLines(opened.handle, expectedExecutionRoot);
+            if (finding?.kind === "tainted") {
+                return { kind: "tainted", journal: journalPath, recordType: finding.recordType };
+            }
+            if (finding?.kind === "environment") {
+                return { kind: "environment", journal: journalPath, recordType: finding.recordType };
             }
         }
         finally {
@@ -363,6 +444,8 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
  *   CLI_V2_PLAN_MODE_CONFIGURED   details.refusal_kind = "v2-plan-mode-configured"
  *   CLI_V2_CONFIG_UNREADABLE      details.refusal_kind = "v2-config-unreadable"
  *   CLI_V2_EXPERIMENTAL_UNSAFE    details.refusal_kind = "v2-experimental-unsafe", details.selectors
+ *   CLI_V2_ENVIRONMENT_UNSAFE / CLI_V2_WORKSPACE_TRUST_UNSAFE for unsafe config
+ *   KIMI_SESSION_ENVIRONMENT_UNSAFE details.refusal_kind = "session-environment-unsafe"
  *   KIMI_SESSION_PLAN_TAINTED     details.refusal_kind = "session-plan-tainted", details.record_type
  *   KIMI_SESSION_JOURNAL_UNAVAILABLE details.refusal_kind = "session-journal-unavailable"
  * Every message carries a truthful remedy (edit the named setting / start a
@@ -384,6 +467,22 @@ export async function assertNativeV2Preflight(options) {
             details: { refusal_kind: planMode.refusalKind, retryable_after_setup: false },
         });
     }
+    const environment = await inspectEnvironmentConfig(options.kimiHome);
+    if (environment.kind === "refuse") {
+        const code = environment.refusalKind === "v2-environment-configured"
+            ? "CLI_V2_ENVIRONMENT_UNSAFE"
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? "CLI_V2_WORKSPACE_TRUST_UNSAFE"
+                : "CLI_V2_CONFIG_UNREADABLE";
+        const remedy = environment.refusalKind === "v2-environment-configured"
+            ? `Remove \`environments.default\` in ${configPath} so plugin-managed sessions stay local.`
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? `Set \`workspace.require_trust = true\` (or remove it) in ${configPath}.`
+                : `Fix or remove the unreadable file at ${configPath} so the execution environment can be verified as local.`;
+        throw new RuntimeError(code, `${environment.reason} ${remedy}`, stage, {
+            details: { refusal_kind: environment.refusalKind, retryable_after_setup: false },
+        });
+    }
     const experimental = await inspectExperimentalSelectors(options.kimiHome, options.env);
     if (experimental.kind === "refuse") {
         throw new RuntimeError("CLI_V2_EXPERIMENTAL_UNSAFE", `${experimental.reason} Unset the listed selector(s) before retrying.`, stage, {
@@ -395,7 +494,16 @@ export async function assertNativeV2Preflight(options) {
         });
     }
     if (options.resumeSessionId !== undefined) {
-        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId);
+        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId, options.expectedExecutionRoot);
+        if (journalScan.kind === "environment") {
+            throw new RuntimeError("KIMI_SESSION_ENVIRONMENT_UNSAFE", `Saved session ${options.resumeSessionId} has an unsafe execution environment binding (${journalScan.recordType} in ${journalScan.journal}). Start a fresh local session; saved session state was not modified.`, stage, {
+                details: {
+                    refusal_kind: "session-environment-unsafe",
+                    record_type: journalScan.recordType,
+                    retryable_after_setup: false,
+                },
+            });
+        }
         if (journalScan.kind === "tainted") {
             throw new RuntimeError("KIMI_SESSION_PLAN_TAINTED", `Saved session ${options.resumeSessionId} previously entered plan mode (record type "${journalScan.recordType}" in ${journalScan.journal}). Start a fresh session; saved session state was not modified.`, stage, {
                 details: {