kimi-plugin-cc 2.5.2 → 2.5.4

package/plugins/kimi-dsh/dist/native-v2-preflight.js

@@ -13,9 +13,10 @@
 //     B. the EnterPlanMode tool (already hook-denied for every label);
 //     C. resuming a session whose agent wire journal holds a durable
 //        `plan_mode.enter` record (restore() folds ONLY agents/*/wire.jsonl).
-//   This module closes A and C before any process is spawned, and refuses the
+//   This module closes A and C before any process is spawned, refuses the
 //   v2-only experimental features (tower, subagent fork) that this plugin does
-//   not certify. B stays in runtime/hooks/approval-policy.ts.
+//   not certify, and requires local execution for configured and resumed sessions.
+//   B stays in runtime/hooks/approval-policy.ts.
 //
 // Contract:
 //   - Pure inspection: never writes, never rewrites operator config, never
@@ -155,6 +156,48 @@ export async function inspectPlanModeConfig(kimiHome) {
         reason: `\`${offending.join("`, `")}\` (upstream setting \`default_plan_mode\`) is set in ${configPath} and is not \`false\`.`,
     };
 }
+export async function inspectEnvironmentConfig(kimiHome) {
+    const parsed = await readParsedConfig(kimiHome);
+    if (parsed.kind === "unreadable") {
+        return { kind: "refuse", refusalKind: "v2-config-unreadable", reason: parsed.reason };
+    }
+    const section = parsed.config?.["environments"];
+    if (section !== undefined) {
+        if (section === null || typeof section !== "object" || Array.isArray(section)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "The [environments] section is not a table, so the execution environment cannot be verified as local.",
+            };
+        }
+        if (section["default"] !== undefined) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-environment-configured",
+                reason: "A default remote execution environment is configured in [environments]; plugin-managed jobs require the local environment.",
+            };
+        }
+    }
+    const workspace = parsed.config?.["workspace"];
+    if (workspace !== undefined) {
+        if (workspace === null || typeof workspace !== "object" || Array.isArray(workspace)) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "The [workspace] section is not a table, so project trust requirements cannot be verified.",
+            };
+        }
+        const trustDisabled = Object.entries(workspace).some(([key, value]) => upstreamSnakeToCamel(key) === "requireTrust" && value !== true);
+        if (trustDisabled) {
+            return {
+                kind: "refuse",
+                refusalKind: "v2-workspace-trust-disabled",
+                reason: "Workspace trust is disabled in [workspace]; plugin-managed jobs require project trust enforcement to remain enabled.",
+            };
+        }
+    }
+    return { kind: "ok" };
+}
 /**
  * Refuse v2-only experimental features this plugin does not certify.
  * Sources (per-flag precedence upstream is env → [experimental] config →
@@ -239,40 +282,39 @@ async function openJournalSafely(journalPath, maxBytes) {
     }
     return { kind: "ok", handle };
 }
-/**
- * Scan one open journal's lines for a plan-mode control record. Returns the
- * record `type` string on a match, "<unparseable>" for a suspicious line
- * that fails to parse, or null when the journal is clean.
- */
-async function scanJournalLines(handle) {
+async function scanJournalLines(handle, expectedExecutionRoot) {
     const rl = createInterface({ input: handle.createReadStream() });
     try {
         for await (const rawLine of rl) {
             const line = rawLine.trim();
             if (line.length === 0)
                 continue;
-            // Parse EVERY record and check its DECODED `type`. A raw-substring filter
-            // is unsafe on its own: a JSON-escaped type such as
-            // {"type":"plan_mode.enter"} contains no literal "plan_mode." yet
-            // upstream JSON.parse decodes it to "plan_mode.enter" and restores active
-            // plan mode. So parse first (this catches the escape). If a line FAILS to
-            // parse, upstream cannot fold it into a plan event either — but be
-            // conservative: a malformed line that still LOOKS plan-related is treated
-            // as tainted rather than skipped, so a hand-corrupted journal cannot hide
-            // a plan record behind a parse error.
             let parsed;
             try {
                 parsed = JSON.parse(line);
             }
             catch {
                 if (line.includes('"plan_mode.') || line.includes('"plan.')) {
-                    return "<unparseable>";
+                    return { kind: "tainted", recordType: "<unparseable>" };
+                }
+                if (line.includes('"environment.set_binding')) {
+                    return { kind: "environment", recordType: "<unparseable-environment-binding>" };
                 }
                 continue;
             }
-            const type = parsed?.["type"];
+            const record = parsed;
+            const type = record?.["type"];
             if (typeof type === "string" && (type.startsWith("plan_mode.") || type.startsWith("plan."))) {
-                return type;
+                return { kind: "tainted", recordType: type };
+            }
+            if (type === "environment.set_binding") {
+                if (record?.["environmentId"] !== "local") {
+                    return { kind: "environment", recordType: type };
+                }
+                const cwd = record?.["cwd"];
+                if (expectedExecutionRoot !== undefined && cwd !== undefined && cwd !== expectedExecutionRoot) {
+                    return { kind: "environment", recordType: "environment.set_binding.cwd" };
+                }
             }
         }
         return null;
@@ -281,16 +323,48 @@ async function scanJournalLines(handle) {
         rl.close();
     }
 }
+async function inspectSessionMetadataEnvironment(statePath, expectedExecutionRoot) {
+    const read = await readSmallFileSafe(statePath, CONFIG_MAX_BYTES);
+    if (read.kind === "absent")
+        return null;
+    if (read.kind === "unreadable") {
+        return { kind: "unavailable", reason: `${statePath}: ${read.reason}` };
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(read.contents);
+    }
+    catch {
+        return { kind: "unavailable", reason: `${statePath}: malformed session metadata` };
+    }
+    if (metadata === null || typeof metadata !== "object" || Array.isArray(metadata)) {
+        return { kind: "unavailable", reason: `${statePath}: invalid session metadata` };
+    }
+    const record = metadata;
+    const environmentId = record["environmentId"];
+    if (environmentId !== undefined && environmentId !== "local") {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentId" };
+    }
+    const environmentCwd = record["environmentCwd"];
+    if ((environmentId === undefined || environmentId === "local") &&
+        expectedExecutionRoot !== undefined &&
+        environmentCwd !== undefined &&
+        environmentCwd !== expectedExecutionRoot) {
+        return { kind: "environment", journal: statePath, recordType: "session.metadata.environmentCwd" };
+    }
+    return null;
+}
 /**
- * Scan every agent wire journal of a saved session for plan-mode records.
- * Layout at 0.42.0: `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
+ * Scan saved session metadata and every agent wire journal for plan-mode records
+ * and nonlocal environment bindings. Layout at 0.42.0:
+ * `<kimiHome>/sessions/<workspaceId>/<sessionId>/agents/<agentId>/wire.jsonl`
  * (workspaceId is unknown to the plugin → enumerate `sessions/*` with bounded
  * readdir). Raw-line scan of EVERY agent journal: a JSON line whose `type`
- * starts with `plan_mode.` or `plan.` → tainted (fail-closed on a line that
- * looks suspicious but does not parse). No session dir, no journal, unreadable,
+ * starts with `plan_mode.` or `plan.` → tainted; `environment.set_binding` must
+ * name `environmentId:"local"`. No session dir, no journal, unreadable metadata,
  * or any single journal above the size cap → unavailable. Never modifies files.
  */
-export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
+export async function scanSessionJournalsForPlan(kimiHome, sessionId, expectedExecutionRoot) {
     const sessionsDir = path.join(kimiHome, "sessions");
     const workspaceEntries = await boundedReaddir(sessionsDir, DIR_ENUM_CAP);
     if (workspaceEntries.kind === "absent") {
@@ -316,7 +390,11 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
         }
         if (!workspaceEntry.isDirectory())
             continue;
-        const agentsDir = path.join(sessionsDir, workspaceEntry.name, sessionId, "agents");
+        const sessionDir = path.join(sessionsDir, workspaceEntry.name, sessionId);
+        const metadataFinding = await inspectSessionMetadataEnvironment(path.join(sessionDir, "state.json"), expectedExecutionRoot);
+        if (metadataFinding !== null)
+            return metadataFinding;
+        const agentsDir = path.join(sessionDir, "agents");
         const agentEntries = await boundedReaddir(agentsDir, DIR_ENUM_CAP);
         if (agentEntries.kind === "absent")
             continue;
@@ -347,9 +425,12 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
             return { kind: "unavailable", reason: `${journalPath}: ${opened.reason}` };
         }
         try {
-            const taintedType = await scanJournalLines(opened.handle);
-            if (taintedType !== null) {
-                return { kind: "tainted", journal: journalPath, recordType: taintedType };
+            const finding = await scanJournalLines(opened.handle, expectedExecutionRoot);
+            if (finding?.kind === "tainted") {
+                return { kind: "tainted", journal: journalPath, recordType: finding.recordType };
+            }
+            if (finding?.kind === "environment") {
+                return { kind: "environment", journal: journalPath, recordType: finding.recordType };
             }
         }
         finally {
@@ -363,6 +444,8 @@ export async function scanSessionJournalsForPlan(kimiHome, sessionId) {
  *   CLI_V2_PLAN_MODE_CONFIGURED   details.refusal_kind = "v2-plan-mode-configured"
  *   CLI_V2_CONFIG_UNREADABLE      details.refusal_kind = "v2-config-unreadable"
  *   CLI_V2_EXPERIMENTAL_UNSAFE    details.refusal_kind = "v2-experimental-unsafe", details.selectors
+ *   CLI_V2_ENVIRONMENT_UNSAFE / CLI_V2_WORKSPACE_TRUST_UNSAFE for unsafe config
+ *   KIMI_SESSION_ENVIRONMENT_UNSAFE details.refusal_kind = "session-environment-unsafe"
  *   KIMI_SESSION_PLAN_TAINTED     details.refusal_kind = "session-plan-tainted", details.record_type
  *   KIMI_SESSION_JOURNAL_UNAVAILABLE details.refusal_kind = "session-journal-unavailable"
  * Every message carries a truthful remedy (edit the named setting / start a
@@ -384,6 +467,22 @@ export async function assertNativeV2Preflight(options) {
             details: { refusal_kind: planMode.refusalKind, retryable_after_setup: false },
         });
     }
+    const environment = await inspectEnvironmentConfig(options.kimiHome);
+    if (environment.kind === "refuse") {
+        const code = environment.refusalKind === "v2-environment-configured"
+            ? "CLI_V2_ENVIRONMENT_UNSAFE"
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? "CLI_V2_WORKSPACE_TRUST_UNSAFE"
+                : "CLI_V2_CONFIG_UNREADABLE";
+        const remedy = environment.refusalKind === "v2-environment-configured"
+            ? `Remove \`environments.default\` in ${configPath} so plugin-managed sessions stay local.`
+            : environment.refusalKind === "v2-workspace-trust-disabled"
+                ? `Set \`workspace.require_trust = true\` (or remove it) in ${configPath}.`
+                : `Fix or remove the unreadable file at ${configPath} so the execution environment can be verified as local.`;
+        throw new RuntimeError(code, `${environment.reason} ${remedy}`, stage, {
+            details: { refusal_kind: environment.refusalKind, retryable_after_setup: false },
+        });
+    }
     const experimental = await inspectExperimentalSelectors(options.kimiHome, options.env);
     if (experimental.kind === "refuse") {
         throw new RuntimeError("CLI_V2_EXPERIMENTAL_UNSAFE", `${experimental.reason} Unset the listed selector(s) before retrying.`, stage, {
@@ -395,7 +494,16 @@ export async function assertNativeV2Preflight(options) {
         });
     }
     if (options.resumeSessionId !== undefined) {
-        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId);
+        const journalScan = await scanSessionJournalsForPlan(options.kimiHome, options.resumeSessionId, options.expectedExecutionRoot);
+        if (journalScan.kind === "environment") {
+            throw new RuntimeError("KIMI_SESSION_ENVIRONMENT_UNSAFE", `Saved session ${options.resumeSessionId} has an unsafe execution environment binding (${journalScan.recordType} in ${journalScan.journal}). Start a fresh local session; saved session state was not modified.`, stage, {
+                details: {
+                    refusal_kind: "session-environment-unsafe",
+                    record_type: journalScan.recordType,
+                    retryable_after_setup: false,
+                },
+            });
+        }
         if (journalScan.kind === "tainted") {
             throw new RuntimeError("KIMI_SESSION_PLAN_TAINTED", `Saved session ${options.resumeSessionId} previously entered plan mode (record type "${journalScan.recordType}" in ${journalScan.journal}). Start a fresh session; saved session state was not modified.`, stage, {
                 details: {

package/plugins/kimi-dsh/dist/swarm-activation.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { open } from "node:fs/promises";
 import path from "node:path";
@@ -9,7 +10,7 @@ import { assertExecutionPlanMatchesSpawn, assertNoUnsafeExperimentalSelector, }
 import { resolveKimiHome } from "./kimi-home.js";
 import { assertNativeV2Preflight } from "./native-v2-preflight.js";
 import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities, waitForProcessTreeExit, } from "./process-tree.js";
-const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0", "2.4.1"];
+const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3", "2.4.0", "2.4.1", "2.5.0", "2.5.1"];
 const READY_TIMEOUT_MS = 10_000;
 const REST_TIMEOUT_MS = 5_000;
 // Exact 2.4.0 can take longer than 5s to drain session/workspace lifecycle work.
@@ -18,6 +19,8 @@ const JOURNAL_TIMEOUT_MS = 2_000;
 const JOURNAL_POLL_MS = 50;
 const READY_LINE_MAX_CHARS = 65_536;
 const REST_RESPONSE_MAX_BYTES = 1024 * 1024;
+const WEBSOCKET_MAX_FRAMES = 64;
+const WEBSOCKET_RESPONSE_MAX_CHARS = 1024 * 1024;
 const JOURNAL_MAX_BYTES = 64 * 1024 * 1024;
 const DESCENDANT_SNAPSHOT_TIMEOUT_MS = 2_000;
 const DESCENDANT_TRACK_INTERVAL_MS = 50;
@@ -39,11 +42,12 @@ export async function preactivateSwarmSession(options) {
         web = await startWebChild(options, prepared.env, failureCode);
         await verifyMeta(web, prepared.expectedVersion, options.signal, failureCode);
         const model = await resolveProfileModel(web, options, failureCode);
-        identity = await createSession(web, options, failureCode);
+        identity = await createSession(web, options, prepared.expectedVersion, failureCode);
+        await verifyLocalEnvironment(web, identity, options.cwd, prepared.expectedVersion, options.signal, failureCode);
         options.onRecoveryEvent?.({ kind: "session", ...identity });
         profileMutationAttempted = true;
         await postSwarmProfile(web, identity, true, model, options.signal, failureCode);
-        await verifySwarmStatus(web, identity, true, model, options.signal, failureCode);
+        await verifySwarmStatus(web, identity, true, model, prepared.expectedVersion, options.signal, failureCode);
         await shutdownWeb(web, options.signal, failureCode);
         await requireSwarmJournal(prepared.kimiHome, identity, "enter", options.signal, failureCode);
         throwIfAborted(options.signal, failureCode, "swarm-activation.complete");
@@ -86,8 +90,9 @@ export async function deactivateSwarmSession(options) {
         throwIfAborted(options.signal, failureCode, "swarm-deactivation.pre-spawn");
         web = await startWebChild(options, prepared.env, failureCode);
         await verifyMeta(web, prepared.expectedVersion, options.signal, failureCode);
+        await verifyLocalEnvironment(web, options, options.cwd, prepared.expectedVersion, options.signal, failureCode);
         await postSwarmProfile(web, options, false, undefined, options.signal, failureCode);
-        await verifySwarmStatus(web, options, false, undefined, options.signal, failureCode);
+        await verifySwarmStatus(web, options, false, undefined, prepared.expectedVersion, options.signal, failureCode);
         await shutdownWeb(web, options.signal, failureCode);
         await requireSwarmJournal(prepared.kimiHome, options, "exit", options.signal, failureCode);
         options.onRecoveryEvent?.({ kind: "disabled" });
@@ -124,6 +129,7 @@ async function prepareWebSpawn(options, failureCode) {
         await assertNativeV2Preflight({
             kimiHome,
             env: options.env,
+            expectedExecutionRoot: options.cwd,
             stage: "swarm-activation.pre-spawn",
         });
     }
@@ -329,13 +335,29 @@ async function resolveProfileModel(web, options, failureCode) {
     }
     return data.default_model;
 }
-async function createSession(web, options, failureCode) {
-    const data = await restData(web, "POST", "/api/v1/sessions", { metadata: { cwd: options.cwd } }, options.signal, failureCode);
+async function createSession(web, options, expectedVersion, failureCode) {
+    const request = { metadata: { cwd: options.cwd } };
+    if (["2.5.0", "2.5.1"].includes(expectedVersion)) {
+        request.environment_id = "local";
+        request.environment_cwd = options.cwd;
+    }
+    const data = await restData(web, "POST", "/api/v1/sessions", request, options.signal, failureCode);
     if (!isRecord(data) || !validPathId(data.id) || !validPathId(data.workspace_id)) {
         throw failure(failureCode, "swarm-activation.create-session", "Kimi web returned an invalid session identity.");
     }
     return { sessionId: data.id, workspaceId: data.workspace_id };
 }
+async function verifyLocalEnvironment(web, identity, expectedCwd, expectedVersion, signal, failureCode) {
+    if (!["2.5.0", "2.5.1"].includes(expectedVersion))
+        return;
+    const data = await restData(web, "GET", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/environment`, undefined, signal, failureCode);
+    if (!isRecord(data)) {
+        throw failure(failureCode, "swarm-activation.environment", "Kimi web /environment returned an invalid payload.");
+    }
+    if (data.workspace_id !== identity.workspaceId || data.environment_id !== "local" || data.cwd !== expectedCwd) {
+        throw failure(failureCode, "swarm-activation.environment", "Kimi web /environment did not confirm the expected local workspace binding.");
+    }
+}
 async function postSwarmProfile(web, identity, active, model, signal, failureCode) {
     const agentConfig = {
         swarm_mode: active,
@@ -345,24 +367,263 @@ async function postSwarmProfile(web, identity, active, model, signal, failureCod
         agentConfig.model = model;
     await restData(web, "POST", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/profile`, { agent_config: agentConfig }, signal, failureCode);
 }
-async function verifySwarmStatus(web, identity, active, model, signal, failureCode) {
-    const data = await restData(web, "GET", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/status`, undefined, signal, failureCode);
+async function verifySwarmStatus(web, identity, active, model, expectedVersion, signal, failureCode) {
+    const data = ["2.5.0", "2.5.1"].includes(expectedVersion)
+        ? await readWebSocketAgentState(web, identity.sessionId, signal, failureCode)
+        : await restData(web, "GET", `/api/v1/sessions/${encodeURIComponent(identity.sessionId)}/status`, undefined, signal, failureCode);
+    const source = ["2.5.0", "2.5.1"].includes(expectedVersion) ? "agent state" : "/status";
     if (!isRecord(data)) {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status returned an invalid payload.");
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} returned an invalid payload.`);
     }
     if (data.swarm_mode !== active) {
-        throw failure(failureCode, "swarm-activation.status", `Kimi web /status did not confirm swarm_mode=${active}.`, { expected_swarm_mode: active });
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm swarm_mode=${active}.`, { expected_swarm_mode: active });
     }
     if (data.plan_mode !== false) {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status did not confirm plan mode is off.");
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm plan mode is off.`);
     }
-    if (data.permission !== "auto") {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status did not confirm auto permission mode.");
+    if (["2.5.0", "2.5.1"].includes(expectedVersion) && data.tower_mode !== false) {
+        throw failure(failureCode, "swarm-activation.status", "Kimi web agent state did not confirm tower mode is off.");
+    }
+    const permission = ["2.5.0", "2.5.1"].includes(expectedVersion) ? data.permission_mode : data.permission;
+    if (permission !== "auto") {
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm auto permission mode.`);
     }
     if (active && data.model !== model) {
-        throw failure(failureCode, "swarm-activation.status", "Kimi web /status did not confirm the selected model alias.");
+        throw failure(failureCode, "swarm-activation.status", `Kimi web ${source} did not confirm the selected model alias.`);
     }
 }
+async function readWebSocketAgentState(web, sessionId, signal, failureCode) {
+    throwIfAborted(signal, failureCode, "swarm-activation.status");
+    await refreshOwnedDescendants(web);
+    throwIfAborted(signal, failureCode, "swarm-activation.status");
+    try {
+        return await new Promise((resolve, reject) => {
+            let socket;
+            const bearerProtocol = `kimi-code.bearer.${web.token}`;
+            const helloId = `swarm-activation-hello-${randomUUID()}`;
+            const subscribeId = `swarm-activation-subscribe-${randomUUID()}`;
+            try {
+                const url = new URL(web.origin);
+                url.protocol = "ws:";
+                url.pathname = "/api/v1/ws";
+                socket = new WebSocket(url, bearerProtocol);
+            }
+            catch {
+                reject(failure(failureCode, "swarm-activation.status", "Could not open the authenticated Kimi web agent-state channel."));
+                return;
+            }
+            let settled = false;
+            let serverHello = false;
+            let clientHelloAcknowledged = false;
+            let subscribeSent = false;
+            let subscriptionAcknowledged = false;
+            let closeRequested = false;
+            let latestState;
+            let frames = 0;
+            let receivedChars = 0;
+            const timer = setTimeout(() => {
+                settle(failure(failureCode, "swarm-activation.status", "Kimi web agent-state verification timed out.", { timeout_ms: REST_TIMEOUT_MS }));
+            }, REST_TIMEOUT_MS);
+            const cleanup = () => {
+                clearTimeout(timer);
+                signal?.removeEventListener("abort", onAbort);
+                socket.removeEventListener("open", onOpen);
+                socket.removeEventListener("message", onMessage);
+                socket.removeEventListener("error", onError);
+                socket.removeEventListener("close", onClose);
+                try {
+                    socket.close();
+                }
+                catch {
+                }
+            };
+            const settle = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                if (result instanceof RuntimeError)
+                    reject(result);
+                else
+                    resolve(result);
+            };
+            const rejectState = (message) => {
+                settle(failure(failureCode, "swarm-activation.status", message));
+            };
+            const send = (frame) => {
+                try {
+                    socket.send(JSON.stringify(frame));
+                    return true;
+                }
+                catch {
+                    rejectState("Could not send a Kimi web agent-state control frame.");
+                    return false;
+                }
+            };
+            const completeIfReady = () => {
+                if (serverHello &&
+                    clientHelloAcknowledged &&
+                    subscriptionAcknowledged &&
+                    latestState !== undefined &&
+                    !closeRequested) {
+                    closeRequested = true;
+                    try {
+                        socket.close();
+                    }
+                    catch {
+                        rejectState("Could not close the Kimi web agent-state channel for final validation.");
+                    }
+                }
+            };
+            const onOpen = () => {
+                if (socket.protocol !== bearerProtocol) {
+                    rejectState("Kimi web did not authenticate the agent-state channel with the expected subprotocol.");
+                    return;
+                }
+                send({
+                    type: "client_hello",
+                    id: helloId,
+                    payload: { client_id: "kimi-plugin-cc-swarm-activation" },
+                });
+            };
+            const onMessage = (event) => {
+                if (settled)
+                    return;
+                if (typeof event.data !== "string") {
+                    rejectState("Kimi web agent-state channel returned a non-text frame.");
+                    return;
+                }
+                frames += 1;
+                receivedChars += event.data.length;
+                if (frames > WEBSOCKET_MAX_FRAMES || receivedChars > WEBSOCKET_RESPONSE_MAX_CHARS) {
+                    rejectState("Kimi web agent-state channel exceeded the bounded response limit.");
+                    return;
+                }
+                let frame;
+                try {
+                    frame = JSON.parse(event.data);
+                }
+                catch {
+                    rejectState("Kimi web agent-state channel returned malformed JSON.");
+                    return;
+                }
+                if (!isRecord(frame) || typeof frame.type !== "string") {
+                    rejectState("Kimi web agent-state channel returned an invalid frame.");
+                    return;
+                }
+                if (frame.type === "server_hello") {
+                    if (serverHello || !isRecord(frame.payload) ||
+                        frame.payload.protocol_version !== 2 ||
+                        typeof frame.payload.ws_connection_id !== "string" ||
+                        !isRecord(frame.payload.capabilities) ||
+                        frame.payload.capabilities.event_batching !== false ||
+                        frame.payload.capabilities.compression !== false) {
+                        rejectState("Kimi web agent-state channel did not provide the expected protocol-v2 hello.");
+                        return;
+                    }
+                    serverHello = true;
+                    return;
+                }
+                if (!serverHello) {
+                    rejectState("Kimi web agent-state channel sent data before its protocol hello.");
+                    return;
+                }
+                if (frame.type === "ack") {
+                    if (typeof frame.id !== "string" || typeof frame.code !== "number" || !isRecord(frame.payload)) {
+                        rejectState("Kimi web agent-state channel returned an invalid acknowledgement.");
+                        return;
+                    }
+                    if (frame.id === helloId) {
+                        if (clientHelloAcknowledged || frame.code !== 0) {
+                            rejectState("Kimi web agent-state channel rejected the client hello.");
+                            return;
+                        }
+                        clientHelloAcknowledged = true;
+                        subscribeSent = send({
+                            type: "subscribe_v2",
+                            id: subscribeId,
+                            payload: { session_id: sessionId, transcript: { main: "block" } },
+                        });
+                        return;
+                    }
+                    if (frame.id === subscribeId) {
+                        if (subscriptionAcknowledged || !subscribeSent || frame.code !== 0 ||
+                            !Array.isArray(frame.payload.accepted) ||
+                            frame.payload.accepted.length !== 1 ||
+                            frame.payload.accepted[0] !== sessionId ||
+                            !Array.isArray(frame.payload.not_found) ||
+                            frame.payload.not_found.length !== 0) {
+                            rejectState("Kimi web agent-state channel did not accept the exact main-session subscription.");
+                            return;
+                        }
+                        subscriptionAcknowledged = true;
+                        completeIfReady();
+                        return;
+                    }
+                    rejectState("Kimi web agent-state channel returned an unexpected acknowledgement.");
+                    return;
+                }
+                if (frame.type === "agent") {
+                    if (!subscribeSent || !isAgentStateFrame(frame, sessionId)) {
+                        rejectState("Kimi web agent-state channel returned invalid or misbound main-agent state.");
+                        return;
+                    }
+                    latestState = frame;
+                    completeIfReady();
+                    return;
+                }
+                if (frame.type === "ping") {
+                    if (isRecord(frame.payload) && typeof frame.payload.nonce === "string") {
+                        send({ type: "pong", payload: { nonce: frame.payload.nonce } });
+                    }
+                }
+            };
+            const onAbort = () => {
+                settle(cancelledFailure(failureCode, "swarm-activation.status"));
+            };
+            const onError = () => {
+                rejectState("Kimi web agent-state channel failed before valid state was received.");
+            };
+            const onClose = () => {
+                if (closeRequested &&
+                    serverHello &&
+                    clientHelloAcknowledged &&
+                    subscriptionAcknowledged &&
+                    latestState !== undefined) {
+                    settle(latestState);
+                    return;
+                }
+                rejectState("Kimi web agent-state channel closed before valid state was received.");
+            };
+            signal?.addEventListener("abort", onAbort, { once: true });
+            socket.addEventListener("open", onOpen);
+            socket.addEventListener("message", onMessage);
+            socket.addEventListener("error", onError);
+            socket.addEventListener("close", onClose);
+            if (signal?.aborted === true)
+                onAbort();
+        });
+    }
+    finally {
+        await refreshOwnedDescendants(web);
+    }
+}
+function isAgentStateFrame(frame, sessionId) {
+    return frame.session_id === sessionId &&
+        frame.agent_id === "main" &&
+        typeof frame.event_created_at === "string" &&
+        Number.isFinite(Date.parse(frame.event_created_at)) &&
+        (frame.status === "idle" || frame.status === "running") &&
+        (frame.model === undefined || typeof frame.model === "string") &&
+        (frame.thinking === undefined || typeof frame.thinking === "string") &&
+        (frame.permission_mode === undefined ||
+            frame.permission_mode === "manual" ||
+            frame.permission_mode === "yolo" ||
+            frame.permission_mode === "auto") &&
+        typeof frame.plan_mode === "boolean" &&
+        typeof frame.swarm_mode === "boolean" &&
+        typeof frame.tower_mode === "boolean";
+}
 async function shutdownWeb(web, signal, failureCode) {
     await restData(web, "POST", "/api/v1/shutdown", undefined, signal, failureCode);
     const settlement = await waitForChildClose(web, signal, failureCode);

package/plugins/kimi-dsh/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.5.2";
+export const KIMI_PLUGIN_CC_VERSION = "2.5.4";

package/plugins/kimi-dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "Kimi Code subagents for DeepSeek Harness: all seven ask, review, challenge, rescue, pursue, swarm, and swarm-write operations through the kimi-plugin-cc companion runtime.",
   "type": "module",
   "main": "dist/dsh/index.js",