kimi-plugin-cc 2.5.4 → 2.5.5

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "Kimi for Claude Code: code questions, reviews, fixes, parallel tasks, and MCP tasks through the local Kimi Code CLI.",
-    "version": "2.5.4"
+    "version": "2.5.5"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "kimi",
   "description": "Kimi for Claude Code: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tasks through the local Kimi Code CLI, with PreToolUse safety hooks.",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "homepage": "https://github.com/linxule/kimi-plugin-cc",
   "repository": "https://github.com/linxule/kimi-plugin-cc",
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 > **Post-1.0 release history (v1.0.1 -> present) lives in [ROADMAP-TO-GA.md § Post-GA audit log](./ROADMAP-TO-GA.md#post-ga-audit-log)** and the "Version" / "Upstream compat" lines of [AGENTS.md](./AGENTS.md). Docs-only kimi-code compat checkups that don't bump the plugin version (e.g. the 0.14.2 / 0.14.3 patches) are recorded there, not here. Notable releases are summarized below; the GA entry and full pre-GA detail follow.
 
+## 2.5.5 — 2026-11-07
+
+- Keep every host's managed hook block in one contiguous run: setup inserts a new block directly after the last managed END when only blanks/comments follow it and the parser proves the result equals the appended form, otherwise appends. A block previously appended after Magpie's model tables lost its BEGIN marker when Magpie rewrote them (yetone/magpie#5614), leaving an `END-without-BEGIN` orphan.
+- Scope orphan markers per host. Markers pair only as an adjacent same-host BEGIN→END; another host's orphan is reported by `setup --check` and no longer fails this host, while own and legacy orphans still fail closed. The orphan remedy is plain `/kimi:setup`, never a scoped `--uninstall`, which would disarm a healthy block and leave the other host's orphan.
+- Parse the whole config for the marker-less (absent-state) fallback instead of deleting managed-block lines first. Deleting them could hide a `matcher` that TOML binds to this host's bare hook table from a key written before another host's `[[hooks]]` header, reporting a disabled hook as installed; this predates 2.5.5 and was found in pre-tag review. Host isolation now counts clean exact-command entries against managed blocks carrying that command.
+- Name the native-v2 certified versions in the out-of-range version notice and measure "newer" against the newest exact one, instead of the legacy-v1 0.41.x bound.
+- Pass the full repository gate with 1,421 tests and 18,320 assertions, 330-file package checks across all three distributions, isolated consumer security, 24 real-binary smoke tests (167 assertions, no skips) on exact 2.5.1, and independent Codex and Kimi pre-tag review. Exact CLI certification remains unchanged through 2.5.1; publication does not update installed hosts or operator pins.
+
 ## 2.5.4 — 2026-11-06
 
 - Restore the original platform-neutral bounded-close settlement for swarm agent-state verification after follow-up CI showed that `wasClean` can both accept an early close and reject a valid one. The published 2.5.3 artifact contains the trial condition; this patch carries its revert without re-tagging or republishing it.

package/dist/commands/setup.js

@@ -26,9 +26,9 @@ import { readPluginConfig, writePluginConfig } from "../config.js";
 import { RuntimeError } from "../errors.js";
 import { normalizeTopLevelInlineHooks, validateKimiHookSetForEnvironment, withKimiConfigLock, } from "../hooks/config-safety.js";
 import { buildHookShellCommand, hostIdFromHookCommand, resolveHookScriptPath, resolveHostId, resolveNodeBinary, } from "../hooks/install-paths.js";
-import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
+import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, ORPHAN_MARKER_REMEDY, parseManagedBlock, } from "../hooks/managed-block.js";
 import { formatVersionOutOfRangeWarning, probeKimiVersion, } from "../kimi-version-probe.js";
-import { isNativeV2CertifiedVersion } from "../kimi-engine.js";
+import { isNativeV2CertifiedVersion, NATIVE_V2_CERTIFIED_VERSIONS } from "../kimi-engine.js";
 import { resolveKimiHome } from "../kimi-home.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
@@ -180,7 +180,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         const block = buildManagedBlock(hookScriptPath, context.env, lineEnding, hostId);
         const next = state.kind === "found"
             ? spliceBlock(existing, state.beginLine, state.endLine, block, lineEnding)
-            : appendBlock(existing, block, lineEnding);
+            : insertBlockNearManagedBlocks(existing, blocks, block, lineEnding);
         await assertKimiHookSetValid(next, configPath, "setup.install", context.env);
         const blockWritten = next !== original;
         if (blockWritten)
@@ -256,7 +256,10 @@ async function runCheck(configPath, hookScriptPath, hostId, reviewGateEnabled, w
         nodeExists: (binPath) => existsSync(binPath),
     });
     // Non-blocking coexistence + cruft notices.
-    const { blocks: allBlocks } = parseManagedBlock(existing, hostId);
+    const { blocks: allBlocks, foreignOrphans } = parseManagedBlock(existing, hostId);
+    for (const orphan of foreignOrphans) {
+        warnings.push(`Host "${orphan.hostId}" has an orphaned ${orphan.detail} managed marker at line ${orphan.line + 1}; that host's commands refuse until it is repaired. ${ORPHAN_MARKER_REMEDY}`);
+    }
     const otherHosts = [
         ...new Set(allBlocks.map((b) => effectiveHost(b, hostId)).filter((h) => h !== hostId)),
     ];
@@ -303,7 +306,9 @@ async function runCheck(configPath, hookScriptPath, hostId, reviewGateEnabled, w
             reviewGateEnabled,
             nextStep: installedCheck.state.kind === "absent"
                 ? "Run /kimi:setup (without --check) to install the managed block."
-                : "Run /kimi:setup --uninstall, then /kimi:setup to repair.",
+                : installedCheck.state.kind === "orphan"
+                    ? ORPHAN_MARKER_REMEDY
+                    : "Run /kimi:setup --uninstall, then /kimi:setup to repair.",
             details: buildDetails({
                 configPath,
                 hookScriptPath,
@@ -535,6 +540,52 @@ function spliceBlock(contents, beginLine, endLine, replacement, lineEnding) {
     const replacementWithEnding = replacement.endsWith(lineEnding) ? replacement : `${replacement}${lineEnding}`;
     return `${beforeWithSep}${replacementWithEnding}${after}`;
 }
+// Keep every host's block in one contiguous run. Magpie's table rewrite drops
+// comments that follow a table it owns (yetone/magpie#5614): a block appended
+// after such a table loses its BEGIN marker and header, leaving an orphan END.
+// Insert after the last managed END only when nothing but blanks/comments
+// precedes the next header AND the real parser proves the result equals the
+// appended form apart from hook order, so no field can rebind and no value can
+// be split; otherwise append.
+function insertBlockNearManagedBlocks(contents, blocks, block, lineEnding) {
+    if (blocks.length === 0)
+        return appendBlock(contents, block, lineEnding);
+    const anchor = Math.max(...blocks.map((b) => b.endLine));
+    const lines = splitPreservingEnding(contents);
+    for (let i = anchor + 1; i < lines.length; i += 1) {
+        const trimmed = lines[i].trim();
+        if (trimmed.startsWith("["))
+            break;
+        if (trimmed.length > 0 && !trimmed.startsWith("#"))
+            return appendBlock(contents, block, lineEnding);
+    }
+    const rawLines = contents.split(/(?<=\n)/);
+    const head = rawLines.slice(0, anchor + 1).join("");
+    const tail = rawLines.slice(anchor + 1).join("");
+    const appended = appendBlock(contents, block, lineEnding);
+    if (tail.length === 0)
+        return appended;
+    const headWithEnding = head.endsWith("\n") ? head : `${head}${lineEnding}`;
+    const body = block.endsWith(lineEnding) ? block : `${block}${lineEnding}`;
+    const tailSeparator = /^\r?\n/.test(tail) ? "" : lineEnding;
+    const inserted = `${headWithEnding}${lineEnding}${body}${tailSeparator}${tail}`;
+    return sameTomlIgnoringHookOrder(inserted, appended) ? inserted : appended;
+}
+function sameTomlIgnoringHookOrder(a, b) {
+    const canonical = (text) => {
+        const parsed = parseToml(text);
+        const hooks = Array.isArray(parsed.hooks)
+            ? parsed.hooks.map((entry) => JSON.stringify(entry)).sort()
+            : parsed.hooks;
+        return JSON.stringify({ ...parsed, hooks });
+    };
+    try {
+        return canonical(a) === canonical(b);
+    }
+    catch {
+        return false;
+    }
+}
 function appendBlock(contents, block, lineEnding) {
     const base = contents.length === 0 || contents.endsWith(lineEnding) ? contents : `${contents}${lineEnding}`;
     const separator = base.length === 0 ? "" : lineEnding;
@@ -928,7 +979,7 @@ async function collectKimiVersionWarnings(env, warnings) {
     // v2-certified binary would wrongly warn "not certified, commands will refuse".
     if (probe.inTestedRange || isNativeV2CertifiedVersion(probe.version))
         return;
-    warnings.push(formatVersionOutOfRangeWarning(probe, KIMI_PLUGIN_CC_VERSION));
+    warnings.push(formatVersionOutOfRangeWarning(probe, KIMI_PLUGIN_CC_VERSION, NATIVE_V2_CERTIFIED_VERSIONS));
 }
 /**
  * Non-blocking notice for kimi-code's own enabled plugins from

package/dist/hooks/managed-block.js

@@ -26,6 +26,12 @@
 import { parse as parseToml } from "../vendor/smol-toml/parse.js";
 import { classifyHookCommandDrift, describeHookCommandDrift, hostIdFromHookCommand, isOurApprovalHookCommand, } from "./install-paths.js";
 const MARKER_TAG = "kimi-plugin-cc-managed";
+/**
+ * Plain install removes unpaired marker comments for every host and leaves each
+ * host's hook table in place. A scoped uninstall removes only this host's
+ * markers, so it would disarm a healthy block and keep another host's orphan.
+ */
+export const ORPHAN_MARKER_REMEDY = "Run /kimi:setup (without --uninstall or --check) to repair: install removes orphaned managed marker comments for every host and keeps each host's hook table. A scoped --uninstall does not remove another host's orphan marker. Another tool rewriting ~/.kimi-code/config.toml usually causes this.";
 /**
  * Strict BEGIN matcher. Accepts `# === BEGIN kimi-plugin-cc-managed`
  * with an optional `:<host-id>` suffix, an optional ` (vX.Y.Z)` suffix,
@@ -135,40 +141,41 @@ function findMarkers(lines) {
     return hits;
 }
 /**
- * Pair BEGIN/END markers into well-formed blocks. Return the first orphan
- * (BEGIN-without-END or END-without-BEGIN); verification fails closed on either.
+ * Pair BEGIN/END markers into well-formed blocks. A block is a BEGIN followed
+ * immediately (in marker order) by an END with the same host suffix; every
+ * other marker is an orphan. Nested or interleaved markers therefore orphan
+ * both sides rather than being guessed into a block. Callers decide which
+ * orphans fail closed (see `parseManagedBlock`).
  */
 function pairBlocks(lines) {
     const markers = findMarkers(lines);
     const blocks = [];
-    let open = null;
-    for (const marker of markers) {
-        if (marker.kind === "begin") {
-            // A second BEGIN before the previous one closed → the previous is orphaned.
-            if (open !== null)
-                return { orphan: "BEGIN-without-END" };
-            open = marker;
+    const orphans = [];
+    let i = 0;
+    while (i < markers.length) {
+        const marker = markers[i];
+        const next = markers[i + 1];
+        if (marker.kind === "begin" && next !== undefined && next.kind === "end" && next.hostId === marker.hostId) {
+            const body = validateBlockBody(lines.slice(marker.index + 1, next.index));
+            blocks.push({
+                hostId: marker.hostId,
+                beginLine: marker.index,
+                endLine: next.index,
+                commandPath: body.commandPath,
+                valid: body.valid,
+                invalidReason: body.invalidReason,
+            });
+            i += 2;
             continue;
         }
-        // end
-        if (open === null)
-            return { orphan: "END-without-BEGIN" };
-        if (open.hostId !== marker.hostId)
-            return { orphan: "BEGIN-without-END" };
-        const body = validateBlockBody(lines.slice(open.index + 1, marker.index));
-        blocks.push({
-            hostId: open.hostId,
-            beginLine: open.index,
-            endLine: marker.index,
-            commandPath: body.commandPath,
-            valid: body.valid,
-            invalidReason: body.invalidReason,
+        orphans.push({
+            line: marker.index,
+            detail: marker.kind === "begin" ? "BEGIN-without-END" : "END-without-BEGIN",
+            hostId: marker.hostId,
         });
-        open = null;
+        i += 1;
     }
-    if (open !== null)
-        return { orphan: "BEGIN-without-END" };
-    return { blocks };
+    return { blocks, orphans };
 }
 /** Validate the lines BETWEEN a BEGIN/END pair against the safety grammar. */
 function validateBlockBody(rawBody) {
@@ -274,24 +281,30 @@ function validateBlockBody(rawBody) {
 export function parseManagedBlock(contents, hostId) {
     const rawLines = contents.split("\n");
     const lines = rawLines.map((line) => line.replace(/\r$/, ""));
-    const paired = pairBlocks(lines);
-    if ("orphan" in paired) {
-        return { state: { kind: "orphan", detail: paired.orphan }, blocks: [], lines };
+    const { blocks, orphans } = pairBlocks(lines);
+    // An orphan suffixed for ANOTHER host cannot be part of this host's block:
+    // this host's verdict still rests on its own well-formed pair, the whole-file
+    // hook-set validation, and the real-parser cleanliness check. Legacy and own
+    // orphans stay fail-closed because they may be this host's damaged block.
+    const ownOrphan = orphans.find((o) => o.hostId === null || o.hostId === hostId);
+    const foreignOrphans = orphans.filter((o) => o.hostId !== null && o.hostId !== hostId);
+    if (ownOrphan !== undefined) {
+        return { state: { kind: "orphan", detail: ownOrphan.detail }, blocks: [], lines, foreignOrphans };
     }
-    const blocks = paired.blocks;
     // A block belongs to this host when its marker suffix matches or, for a
     // legacy un-suffixed block, its command derives to this host. An unattributable
     // legacy command is claimable by the next installer; a command attributed to
     // another host is ignored so its block remains untouched.
     const relevant = blocks.filter((b) => effectiveHost(b, hostId) === hostId);
     if (relevant.length === 0) {
-        return { state: { kind: "absent" }, blocks, lines };
+        return { state: { kind: "absent" }, blocks, lines, foreignOrphans };
     }
     if (relevant.length > 1) {
         return {
             state: { kind: "duplicate", beginLines: relevant.map((b) => b.beginLine) },
             blocks,
             lines,
+            foreignOrphans,
         };
     }
     const block = relevant[0];
@@ -307,6 +320,7 @@ export function parseManagedBlock(contents, hostId) {
         },
         blocks,
         lines,
+        foreignOrphans,
     };
 }
 /**
@@ -335,27 +349,6 @@ export function decodeManagedCommandLine(trimmedLine) {
         return literal[1];
     return null;
 }
-/**
- * Return `contents` with every well-formed managed BEGIN/END block removed
- * (inclusive), so what remains is only the bare/root TOML. Used by
- * `hasCleanEnforcingHookEntry` to enforce host isolation. If the markers are
- * unbalanced (orphan), returns the input unchanged — the caller is only reached
- * in the `absent` state, where a well-formed foreign block is the norm.
- */
-function stripManagedBlockLines(contents) {
-    const lines = contents.split("\n").map((line) => line.replace(/\r$/, ""));
-    const paired = pairBlocks(lines);
-    if (!("blocks" in paired))
-        return contents;
-    const inBlock = new Set();
-    for (const block of paired.blocks) {
-        for (let i = block.beginLine; i <= block.endLine; i += 1)
-            inBlock.add(i);
-    }
-    if (inBlock.size === 0)
-        return contents;
-    return lines.filter((_, i) => !inBlock.has(i)).join("\n");
-}
 /**
  * True if a parsed `hooks[]` array contains a clean enforcing entry for
  * `expectedCommand`: `event="PreToolUse"`, byte-exact `command`, NO `matcher`
@@ -364,10 +357,11 @@ function stripManagedBlockLines(contents) {
  * kimi-code's strict schema). Each host's hook path is distinct, so the command
  * uniquely identifies this host's entry.
  */
-function hooksArrayHasCleanEntry(hooks, expectedCommand) {
+function countCleanEntries(hooks, expectedCommand) {
     if (!Array.isArray(hooks))
-        return false;
+        return 0;
     const allowedKeys = new Set(["event", "command", "timeout"]);
+    let count = 0;
     for (const entry of hooks) {
         if (entry === null || typeof entry !== "object")
             continue;
@@ -380,29 +374,37 @@ function hooksArrayHasCleanEntry(hooks, expectedCommand) {
             continue;
         if (!Object.keys(rec).every((k) => allowedKeys.has(k)))
             continue;
-        return true;
+        count += 1;
     }
-    return false;
+    return count;
+}
+function hooksArrayHasCleanEntry(hooks, expectedCommand) {
+    return countCleanEntries(hooks, expectedCommand) > 0;
 }
 /**
- * Parser-based fallback used only in the absent state. Strip every managed
- * block first so another host's live hook cannot count for this host, then parse
- * the remaining bare/root TOML with the real parser rather than the prune line
- * scanner. `hooksArrayHasCleanEntry` requires the exact event and command, no
- * matcher in any spelling, and no foreign keys. Parse errors fail closed.
- * Callers run whole-file schema validation first, including timeout ranges.
+ * Parser-based fallback used only in the absent state. Parse the WHOLE file
+ * exactly as kimi-code does: deleting managed-block lines first would change
+ * which table their keys bind to (a `matcher` written before another host's
+ * `[[hooks]]` header belongs to the preceding table, possibly this host's bare
+ * one). Host isolation is kept by counting: every managed block whose body
+ * carries this exact command may account for one clean entry, so only a clean
+ * entry beyond those can be this host's marker-less table. Requires the exact
+ * event and command, no matcher in any spelling, and no foreign keys. Parse
+ * errors fail closed. Callers run whole-file schema validation first.
  */
 export function hasCleanEnforcingHookEntry(contents, expectedCommand) {
     let parsed;
     try {
-        parsed = parseToml(stripManagedBlockLines(contents));
+        parsed = parseToml(contents);
     }
     catch {
         return false;
     }
     if (parsed === null || typeof parsed !== "object")
         return false;
-    return hooksArrayHasCleanEntry(parsed.hooks, expectedCommand);
+    const lines = contents.split("\n").map((line) => line.replace(/\r$/, ""));
+    const managedWithCommand = pairBlocks(lines).blocks.filter((block) => block.commandPath === expectedCommand).length;
+    return countCleanEntries(parsed.hooks, expectedCommand) > managedWithCommand;
 }
 /**
  * Whole-file parser check for the FOUND (marked-block present) path. The line
@@ -468,7 +470,7 @@ export function evaluateInstalled(contents, expectedCommand, opts) {
     if (state.kind === "orphan") {
         return {
             installed: false,
-            reason: `${state.detail} marker. Run /kimi:setup --uninstall to clear.`,
+            reason: `${state.detail} marker. ${ORPHAN_MARKER_REMEDY}`,
             state,
         };
     }
@@ -516,12 +518,9 @@ export function findBareApprovalHookTables(contents) {
     const lines = contents.split("\n").map((line) => line.replace(/\r$/, ""));
     const tableLines = scanTomlLines(contents).tables;
     const managed = new Set();
-    const paired = pairBlocks(lines);
-    if ("blocks" in paired) {
-        for (const block of paired.blocks) {
-            for (let i = block.beginLine; i <= block.endLine; i += 1)
-                managed.add(i);
-        }
+    for (const block of pairBlocks(lines).blocks) {
+        for (let i = block.beginLine; i <= block.endLine; i += 1)
+            managed.add(i);
     }
     const ranges = [];
     for (let i = 0; i < lines.length; i += 1) {

package/dist/kimi-version-probe.js

@@ -194,23 +194,41 @@ export function maxTestedMinor() {
         ? entry
         : max);
 }
+function compareVersions(a, b) {
+    const pa = a.split(".").map((part) => Number.parseInt(part, 10));
+    const pb = b.split(".").map((part) => Number.parseInt(part, 10));
+    for (let i = 0; i < 3; i += 1) {
+        const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
 /**
  * Format a user-facing warning line for an out-of-range version probe.
  * Setup itself may complete, but the execution-plan gate will refuse model
  * spawns until the operator selects a certified binary or updates the plugin.
+ * `nativeV2Certified` is the exact native-v2 table; both engines are named so
+ * the newest certified version is not misreported as the legacy-v1 bound.
  */
-export function formatVersionOutOfRangeWarning(probe, pluginVersion) {
+export function formatVersionOutOfRangeWarning(probe, pluginVersion, nativeV2Certified = []) {
     const tested = KIMI_TESTED_MINORS.map((entry) => `${entry.major}.${entry.minor}.x`).join(", ");
     const max = maxTestedMinor();
-    const aboveMax = probe.major > max.major || (probe.major === max.major && probe.minor > max.minor);
+    const newestNative = [...nativeV2Certified].sort(compareVersions).at(-1);
+    const probeRaw = `${probe.major}.${probe.minor}.${probe.patch}`;
+    const aboveMax = newestNative !== undefined
+        ? compareVersions(probeRaw, newestNative) > 0
+        : probe.major > max.major || (probe.major === max.major && probe.minor > max.minor);
+    const certified = nativeV2Certified.length > 0
+        ? `legacy-v1 ${tested}; native-v2 exact ${nativeV2Certified.join(", ")}`
+        : tested;
     const lines = [
-        `WARNING: kimi-code version ${probe.version} is outside the range kimi-plugin-cc ${pluginVersion} was tested against (${tested}).`,
+        `WARNING: kimi-code version ${probe.version} is outside the versions kimi-plugin-cc ${pluginVersion} certifies (${certified}).`,
     ];
     if (aboveMax) {
-        // Above the legacy-v1 tested upper bound is a release newer than the last
-        // legacy compatibility audit, commonly from out-of-band auto-upgrade drift.
-        lines.push(`  This is NEWER than the newest version we have tested (${max.major}.${max.minor}.x) and is not yet certified for model execution.`);
+        // Commonly out-of-band auto-upgrade drift past the last certification.
+        lines.push(`  This is NEWER than the newest certified version (${newestNative ?? `${max.major}.${max.minor}.x`}) and is not yet certified for model execution.`);
     }
-    lines.push(`  Setup can complete, but model-spawning commands will refuse before Kimi starts rather than run an unreviewed engine/version route.`, `  Update kimi-plugin-cc to a release that certifies this minor, or point KIMI_PLUGIN_CC_KIMI_BIN at a certified kimi-code binary and retry setup.`, `  KIMI_PLUGIN_CC_SKIP_VERSION_PROBE is a test/smoke seam, not a production compatibility override.`);
+    lines.push(`  Setup can complete, but model-spawning commands will refuse before Kimi starts rather than run an unreviewed engine/version route.`, `  Update kimi-plugin-cc to a release that certifies this version, or point KIMI_PLUGIN_CC_KIMI_BIN at a certified kimi-code binary and retry setup.`, `  KIMI_PLUGIN_CC_SKIP_VERSION_PROBE is a test/smoke seam, not a production compatibility override.`);
     return lines.join("\n");
 }

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.5.4";
+export const KIMI_PLUGIN_CC_VERSION = "2.5.5";

package/docs/registry-releases.md

@@ -8,9 +8,11 @@ no separate CLI.
 
 ## Publishing status
 
-Plugin **2.5.4** restores the original platform-neutral bounded-close settlement for swarm agent-state verification after follow-up CI showed that `wasClean` can both accept an early close and reject a valid one. The immutable 2.5.3 artifact contains that trial condition; 2.5.4 carries its revert with deterministic no-close-event coverage and a protocol-correct mock handshake, without changing exact CLI certification through 2.5.1. Activation validation passed 71 tests with 244 assertions, the full repository check passed 1,412 tests with 18,282 assertions, and 330-file package and consumer-security validation passed. Release CI, OIDC publication, registry artifact identity, and the final Discover timestamp are recorded here after publication.
+Plugin **2.5.5** keeps every host's managed hook block contiguous in the shared `~/.kimi-code/config.toml`, so a comment-preserving third-party writer that regroups tables cannot strip a block's BEGIN marker, and scopes orphan-marker verification per host: another host's orphan warns, own and legacy orphans still fail closed, and the remedy is plain setup. Exact CLI certification remains 2.5.0 and 2.5.1; publication does not update installed hosts or operator pins.
 
-Plugin **2.5.3** certifies exact Kimi Code **2.5.0 and 2.5.1** for all eight operations, adding local-execution/workspace-trust closures and authenticated WebSocket swarm activation with deterministic close-timeout coverage while preserving the no-plan construction and legacy-v1 0.41.x boundary. See the [2.5.0](./upstream-2.5.0-certification.md) and [2.5.1](./upstream-2.5.1-certification.md) certification records. The 2.5.1 source scan passed 18 tests with 153 assertions; candidate and production matrices each passed 24 tests with 167 assertions and no skips. The full check passed 1,412 tests with 18,282 assertions, package validation passed 330 files across all three distributions, isolated consumer security passed, and independent read-only `claude -p` review returned APPROVE. [Release v2.5.3](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.3) is anchored at `11d862a3fd9dae006c6888bfa221ea73101fb171`. [Final release-commit CI](https://github.com/linxule/kimi-plugin-cc/actions/runs/42237176295) and [OIDC publication](https://github.com/linxule/kimi-plugin-cc/actions/runs/42238045923) passed. The 330-file registry tarball has SHA-1 `6aa5ab4a2c862347e14354698b2ba6f7f8b1defd`, matches the validated workflow artifact byte-for-byte, and carries provenance (sigstore log index `3719667960`). A fresh registry npm installation has zero production advisories; isolated Claude Code, Codex, and DSH setup/checks pass, and all compiled runtime mirrors match. The Discover timestamp records npm publication at `2026-11-06T15:01:13.468Z`. Follow-up CI showed that `wasClean` is inconsistent and has been reverted on `main`; the published 2.5.3 artifact contains the trial condition, so carrying the revert requires a separately authorized patch release.
+Plugin **2.5.4** restores the original platform-neutral bounded-close settlement for swarm agent-state verification after follow-up CI showed that `wasClean` can both accept an early close and reject a valid one. The immutable 2.5.3 artifact contains that trial condition; 2.5.4 carries its revert with deterministic no-close-event coverage and a protocol-correct mock handshake, without changing exact CLI certification through 2.5.1. Activation validation passed 71 tests with 244 assertions, the full repository check passed 1,412 tests with 18,282 assertions, and 330-file package and consumer-security validation passed. [Release v2.5.4](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.4) is anchored at `836da262ae303f51c9049b2711c9d957d7692ed2`. [Release-commit CI](https://github.com/linxule/kimi-plugin-cc/actions/runs/42249517714) and [OIDC publication](https://github.com/linxule/kimi-plugin-cc/actions/runs/42251575637) passed. The 330-file registry tarball has SHA-1 `b9e23fe6b1ceb54fdc5ee26447da050653526b7f`, matches the validated workflow artifact byte-for-byte, and carries provenance (sigstore log index `3721306580`). A fresh registry npm installation has zero production advisories; isolated Claude Code, Codex, and DSH setup/checks pass, and all compiled runtime mirrors match. The Discover timestamp records npm publication at `2026-11-06T16:29:28.637Z`.
+
+Plugin **2.5.3** certifies exact Kimi Code **2.5.0 and 2.5.1** for all eight operations, adding local-execution/workspace-trust closures and authenticated WebSocket swarm activation with deterministic close-timeout coverage while preserving the no-plan construction and legacy-v1 0.41.x boundary. See the [2.5.0](./upstream-2.5.0-certification.md) and [2.5.1](./upstream-2.5.1-certification.md) certification records. The 2.5.1 source scan passed 18 tests with 153 assertions; candidate and production matrices each passed 24 tests with 167 assertions and no skips. The full check passed 1,412 tests with 18,282 assertions, package validation passed 330 files across all three distributions, isolated consumer security passed, and independent read-only `claude -p` review returned APPROVE. [Release v2.5.3](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.3) is anchored at `11d862a3fd9dae006c6888bfa221ea73101fb171`. [Final release-commit CI](https://github.com/linxule/kimi-plugin-cc/actions/runs/42237176295) and [OIDC publication](https://github.com/linxule/kimi-plugin-cc/actions/runs/42238045923) passed. The 330-file registry tarball has SHA-1 `6aa5ab4a2c862347e14354698b2ba6f7f8b1defd`, matches the validated workflow artifact byte-for-byte, and carries provenance (sigstore log index `3719667960`). A fresh registry npm installation has zero production advisories; isolated Claude Code, Codex, and DSH setup/checks pass, and all compiled runtime mirrors match. The Discover timestamp records npm publication at `2026-11-06T15:01:13.468Z`. Follow-up CI showed that `wasClean` is inconsistent and has been reverted on `main`; the published 2.5.3 artifact contains the trial condition. [Plugin 2.5.4](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.4) carries the correction.
 
 Plugin **2.5.2** hardens setup recovery and DSH dependency ownership. Its real Kimi Code **2.4.1** smoke passed **24 tests and 167 assertions with no skips**; the exact-source audit passed **16 tests and 97 assertions**. Normal npm installation keeps DSH host services optional. DSH use requires explicitly patched host/profile dependencies and both installation audits described below. Exact CLI certification remains unchanged. [Release v2.5.2](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.2) is anchored at `8b303bb6e49c581ad96c72bd031e8fd1643c9121`. [Release-commit CI](https://github.com/linxule/kimi-plugin-cc/actions/runs/41361753223) and [npm publication](https://github.com/linxule/kimi-plugin-cc/actions/runs/41362262009) passed. The 328-file registry tarball has SHA-1 `e620040dd35986a6929be7ad677642729a3126e7`, matches the validated workflow artifact byte-for-byte, and carries provenance (sigstore log index `3636981979`). A fresh registry npm installation has zero production advisories; isolated Claude Code, Codex, and DSH setup/checks pass, and all compiled runtime mirrors match. The Discover timestamp records npm publication at `2026-11-01T23:35:04.270Z`.
 

package/docs/upstream-2.5.0-certification.md

@@ -48,3 +48,5 @@ After the original certification, Linux release CI exposed a platform-specific e
 A subsequent CI attempt showed that native WebSocket close scheduling and `wasClean` semantics vary by platform and cannot supply a deterministic no-close-event precondition. That timeout case now uses a controlled socket which completes the protocol exchange but never emits `close`, and asserts the exact `Kimi web agent-state verification timed out.` message. The refusal is therefore tested without relying on incidental host close timing; production behavior is unchanged by this test-only follow-up.
 
 **Follow-up correction:** a later normal activation/deactivation fixture showed that `wasClean` can also reject a valid close. The production condition has been reverted on `main`, restoring the original certified bounded-close settlement; the controlled no-close-event test and protocol-correct mock handshake remain. The immutable 2.5.3 artifact contains the trial condition, so carrying this revert requires a new patch artifact rather than a re-tag or republish.
+
+The correction ships as plugin 2.5.4 ([release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.4)), with registry artifact and fresh-install verification recorded in [registry releases](registry-releases.md).

package/docs/upstream-2.5.1-certification.md

@@ -43,3 +43,5 @@ After the original certification and independent review, Linux release CI expose
 A subsequent CI attempt showed that native WebSocket close scheduling and `wasClean` semantics vary by platform and cannot supply a deterministic no-close-event precondition. That timeout case now uses a controlled socket which completes the protocol exchange but never emits `close`, and asserts the exact `Kimi web agent-state verification timed out.` message. The refusal is therefore tested without relying on incidental host close timing; production behavior is unchanged by this test-only follow-up.
 
 **Follow-up correction:** a later normal activation/deactivation fixture showed that `wasClean` can also reject a valid close. The production condition has been reverted on `main`, restoring the original certified bounded-close settlement; the controlled no-close-event test and protocol-correct mock handshake remain. The immutable 2.5.3 artifact contains the trial condition, so carrying this revert requires a new patch artifact rather than a re-tag or republish.
+
+The correction ships as plugin 2.5.4 ([release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.5.4)), with registry artifact and fresh-install verification recorded in [registry releases](registry-releases.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi-plugin-cc",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "description": "Kimi for Claude Code, Codex, and DeepSeek Harness: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP tools through the local Kimi Code CLI.",
   "type": "module",
   "main": "dist/dsh/index.js",

package/plugins/kimi-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kimi",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "description": "Kimi for Codex: code questions, independent reviews, bounded fixes, autonomous goals, parallel tasks, and MCP job controls through the local Kimi Code CLI.",
   "author": {
     "name": "linxule"

package/plugins/kimi-codex/dist/commands/setup.js

@@ -26,9 +26,9 @@ import { readPluginConfig, writePluginConfig } from "../config.js";
 import { RuntimeError } from "../errors.js";
 import { normalizeTopLevelInlineHooks, validateKimiHookSetForEnvironment, withKimiConfigLock, } from "../hooks/config-safety.js";
 import { buildHookShellCommand, hostIdFromHookCommand, resolveHookScriptPath, resolveHostId, resolveNodeBinary, } from "../hooks/install-paths.js";
-import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
+import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, ORPHAN_MARKER_REMEDY, parseManagedBlock, } from "../hooks/managed-block.js";
 import { formatVersionOutOfRangeWarning, probeKimiVersion, } from "../kimi-version-probe.js";
-import { isNativeV2CertifiedVersion } from "../kimi-engine.js";
+import { isNativeV2CertifiedVersion, NATIVE_V2_CERTIFIED_VERSIONS } from "../kimi-engine.js";
 import { resolveKimiHome } from "../kimi-home.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
@@ -180,7 +180,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         const block = buildManagedBlock(hookScriptPath, context.env, lineEnding, hostId);
         const next = state.kind === "found"
             ? spliceBlock(existing, state.beginLine, state.endLine, block, lineEnding)
-            : appendBlock(existing, block, lineEnding);
+            : insertBlockNearManagedBlocks(existing, blocks, block, lineEnding);
         await assertKimiHookSetValid(next, configPath, "setup.install", context.env);
         const blockWritten = next !== original;
         if (blockWritten)
@@ -256,7 +256,10 @@ async function runCheck(configPath, hookScriptPath, hostId, reviewGateEnabled, w
         nodeExists: (binPath) => existsSync(binPath),
     });
     // Non-blocking coexistence + cruft notices.
-    const { blocks: allBlocks } = parseManagedBlock(existing, hostId);
+    const { blocks: allBlocks, foreignOrphans } = parseManagedBlock(existing, hostId);
+    for (const orphan of foreignOrphans) {
+        warnings.push(`Host "${orphan.hostId}" has an orphaned ${orphan.detail} managed marker at line ${orphan.line + 1}; that host's commands refuse until it is repaired. ${ORPHAN_MARKER_REMEDY}`);
+    }
     const otherHosts = [
         ...new Set(allBlocks.map((b) => effectiveHost(b, hostId)).filter((h) => h !== hostId)),
     ];
@@ -303,7 +306,9 @@ async function runCheck(configPath, hookScriptPath, hostId, reviewGateEnabled, w
             reviewGateEnabled,
             nextStep: installedCheck.state.kind === "absent"
                 ? "Run /kimi:setup (without --check) to install the managed block."
-                : "Run /kimi:setup --uninstall, then /kimi:setup to repair.",
+                : installedCheck.state.kind === "orphan"
+                    ? ORPHAN_MARKER_REMEDY
+                    : "Run /kimi:setup --uninstall, then /kimi:setup to repair.",
             details: buildDetails({
                 configPath,
                 hookScriptPath,
@@ -535,6 +540,52 @@ function spliceBlock(contents, beginLine, endLine, replacement, lineEnding) {
     const replacementWithEnding = replacement.endsWith(lineEnding) ? replacement : `${replacement}${lineEnding}`;
     return `${beforeWithSep}${replacementWithEnding}${after}`;
 }
+// Keep every host's block in one contiguous run. Magpie's table rewrite drops
+// comments that follow a table it owns (yetone/magpie#5614): a block appended
+// after such a table loses its BEGIN marker and header, leaving an orphan END.
+// Insert after the last managed END only when nothing but blanks/comments
+// precedes the next header AND the real parser proves the result equals the
+// appended form apart from hook order, so no field can rebind and no value can
+// be split; otherwise append.
+function insertBlockNearManagedBlocks(contents, blocks, block, lineEnding) {
+    if (blocks.length === 0)
+        return appendBlock(contents, block, lineEnding);
+    const anchor = Math.max(...blocks.map((b) => b.endLine));
+    const lines = splitPreservingEnding(contents);
+    for (let i = anchor + 1; i < lines.length; i += 1) {
+        const trimmed = lines[i].trim();
+        if (trimmed.startsWith("["))
+            break;
+        if (trimmed.length > 0 && !trimmed.startsWith("#"))
+            return appendBlock(contents, block, lineEnding);
+    }
+    const rawLines = contents.split(/(?<=\n)/);
+    const head = rawLines.slice(0, anchor + 1).join("");
+    const tail = rawLines.slice(anchor + 1).join("");
+    const appended = appendBlock(contents, block, lineEnding);
+    if (tail.length === 0)
+        return appended;
+    const headWithEnding = head.endsWith("\n") ? head : `${head}${lineEnding}`;
+    const body = block.endsWith(lineEnding) ? block : `${block}${lineEnding}`;
+    const tailSeparator = /^\r?\n/.test(tail) ? "" : lineEnding;
+    const inserted = `${headWithEnding}${lineEnding}${body}${tailSeparator}${tail}`;
+    return sameTomlIgnoringHookOrder(inserted, appended) ? inserted : appended;
+}
+function sameTomlIgnoringHookOrder(a, b) {
+    const canonical = (text) => {
+        const parsed = parseToml(text);
+        const hooks = Array.isArray(parsed.hooks)
+            ? parsed.hooks.map((entry) => JSON.stringify(entry)).sort()
+            : parsed.hooks;
+        return JSON.stringify({ ...parsed, hooks });
+    };
+    try {
+        return canonical(a) === canonical(b);
+    }
+    catch {
+        return false;
+    }
+}
 function appendBlock(contents, block, lineEnding) {
     const base = contents.length === 0 || contents.endsWith(lineEnding) ? contents : `${contents}${lineEnding}`;
     const separator = base.length === 0 ? "" : lineEnding;
@@ -928,7 +979,7 @@ async function collectKimiVersionWarnings(env, warnings) {
     // v2-certified binary would wrongly warn "not certified, commands will refuse".
     if (probe.inTestedRange || isNativeV2CertifiedVersion(probe.version))
         return;
-    warnings.push(formatVersionOutOfRangeWarning(probe, KIMI_PLUGIN_CC_VERSION));
+    warnings.push(formatVersionOutOfRangeWarning(probe, KIMI_PLUGIN_CC_VERSION, NATIVE_V2_CERTIFIED_VERSIONS));
 }
 /**
  * Non-blocking notice for kimi-code's own enabled plugins from