* fix(kap-server): accept question ids containing colons on resolve
Some OpenAI-compatible providers emit tool_call ids like
`AskUserQuestion:0`, which the question service adopts as the question
id. The action-suffix parse then rejected the bare resolve POST as an
unsupported action (40001), so clients could never submit answers.
When the suffix parse fails, fall back to matching the full tail
against the pending question list before emitting 40001. Also add
maxRetries to the test home cleanup to absorb the async query-store
shard flush (ENOTEMPTY on macOS), matching fs.test.ts.
* fix(kap-server): preserve 40902 on duplicate resolve of colon-id questions
A retried bare resolve of a colon-bearing question id re-entered the
invalid-suffix fallback after the question settled, found no pending
match, and returned 40001 — bypassing the recently-resolved idempotency
window. Accept the tail in the fallback when it is recently resolved so
the shared duplicate-resolve path emits 40902 as documented.
* fix(acp): preserve cancels that arrive before the turn id is known
A session/cancel landing between prompt submission and the launch
round-trip found driver.turnId undefined and was dropped entirely; the
turn then ran to completion and the prompt resolved end_turn despite
the client's cancel.
The engine's cancel payload makes turnId optional (an empty call
cancels the active turn — the same contract kap-server's cancel route
relies on), so cancel() now issues an unaddressed cancel in that window
and flags the driver; the launch handler re-issues a precisely
addressed cancel once the id lands, and a no-launch outcome settles
cancelled instead of end_turn.
* fix(agent-core-v2): shut session MCP overlays down on service teardown
The ephemeral per-session MCP overlay was only shut down by the
session handle's dispose wrapper, but the DI container disposes session
scopes directly on workspace/app teardown, bypassing the wrapper — so
overlays of sessions still live at shutdown leaked their MCP
connections and stdio child processes.
Track live overlays in the lifecycle service: the handle wrapper
deletes-then-shuts-down (atomic, so close and service disposal can
never double-shutdown), and the service's own dispose shuts down
whatever is still tracked.
* feat(acp-server): bridge questions via elicitation and support host slash commands
- route AskUserQuestion through `elicitation/create` for form-capable
clients (native multi-question + multi-select), falling back to the
`request_permission` bridge on RPC failure
- add a `slashCommands` resolver option so hosts can merge their own
command palette and skill aliases into `available_commands_update`;
`/help` now lists the merged palette
- bridge `appendText`/`writeBytes` through client text capabilities
(read-modify-write append, UTF-8-checked byte writes) with local
filesystem fallbacks
- defer `available_commands_update` until after the lifecycle response
settles so clients like Zed do not drop the notification
- propagate plan-toggle errors from `setMode` instead of silently
reporting the new mode; make server `close()` idempotent
* style(acp-server): satisfy oxlint eqeqeq and await-thenable rules
* test(node-sdk): assert v1-v2 tokenCount parity for imports after eager counting
* feat(acp): add agent-core-v2 ACP server
- add ACP session lifecycle, configuration, permissions, and event bridging
- expose the experimental kimi acp-v2 command with terminal authentication
- add integration coverage and workspace build configuration
* test: use neutral example domains in test fixtures and docs
- replace placeholder hostnames (evil.com, foo.com, internal.corp,
real.corp) with example.test / example.com in agent-core-v2 and
kap-server tests
- replace fixture emails (x@y.com, a@x.com) with example addresses in
minidb tests and README
* fix(acp): align acp-server with agent-core-v2 interfaces and address review
- add missing appendText to AcpHostFileSystem (IHostFileSystem drift)
- replace IAgentPromptService.prompt with inject
- use Turn.cancel() instead of abortController
- gate FS reverse-RPCs on client capabilities, fallback to local FS
- return PROTOCOL_VERSION constant instead of echoing client version
- remove misleading mcpCapabilities from initialize response
- dispose old session wrapper before replacing on load/resume
- fix object stringification lint error in convert.ts
- add acp-v2 to expected CLI sub-command list in test
* fix(acp): use enqueue for prompt submission, stop advertising unimplemented builtins
- replace IAgentPromptService.inject with enqueue so onBeforeSubmitPrompt
hooks (prompt-blocking policy) are not bypassed
- stop advertising builtin slash commands (/help, /status, etc.) until
builtin command execution is implemented
- add comment explaining appendText stays local (ACP has no append RPC)
- update skills test to match new availableCommands behavior
* fix(acp): filter turn events by turnId, surface auth failures as auth_required
- track turnId in driveTurn and ignore events from unrelated turns,
preventing queued prompts from settling on the running turn
- reject prompt requests with auth_required when turn fails with an
auth-related error code, enabling ACP client re-auth flow
* fix(acp): gate acp-v2 behind experimental flag, filter sessions by cwd
- add acp-v2 experimental flag (KIMI_CODE_EXPERIMENTAL_ACP_V2) and gate
CLI command registration behind it
- filter session/list results by requested cwd instead of returning
sessions from all workspaces
- detect hook-blocked prompts via PromptHandle.state and add TODO for
streaming block messages once the hook context exposes them
* refactor(acp-server): rewire ACP server onto the klient facade
- replace direct agent-core-v2 scope/service access (ISessionLifecycleService,
ISessionIndex, IEventBus, ISessionInteractionService, etc.) with the Klient
facade: klient.global.sessions / klient.session(id) / agent('main') handles
- drive turns via agent.prompt() + session-level agent event subscriptions
instead of per-prompt IEventBus wiring; settle on turn.ended
- route approval/question bridging through session.interactions events
- hide the thinking config option and skill catalog behind KLIENT-GAP markers
until klient exposes those surfaces
- acp-fs: pass realpath through to the local inner backend
- klient: session.restore() rejects both null and undefined handles
* feat(agent-core-v2): add session delete and ephemeral per-session MCP servers
- add ISessionLifecycleService.delete: close a live session first, then
remove its persisted data, evict the index read-model entry, and append
a deleted tombstone to session_index.jsonl; unknown ids raise
session.not_found
- add CreateSessionOptions/ResumeSessionOptions.mcpServers: session-owned
MCP overlay merged over the workspace manager via
MergedMcpConnectionView (an ephemeral name shadows a workspace server),
never persisted, released when the session scope tears down
- return PromptLaunchResult from activateSkill so callers get the
launched turn id and activation failures (unknown skill, busy) surface
- add ISessionSkillCatalog.list() as a wire-friendly catalog snapshot
- add ISessionIndex.remove for read-model eviction on delete
* feat(klient): expose session delete, per-session MCP, skills, and stream events
- session lifecycle contract: delete, resume/restore options, and
CreateSessionOptions.mcpServers (ephemeral per-session MCP servers)
- add the session skills contract and facade accessors for the
wire-friendly skill catalog snapshot
- register tool.call.delta, tool.progress, and compaction.* agent stream
events so consumers can subscribe with typed payloads
* feat(acp-server): align ACP v2 server with acp-adapter capabilities
- complete the klient-facade rewire: ACP client connection holder and
the terminal/* reverse-RPC runner routed through the Agent scope
- negotiate the protocol version on initialize instead of pinning v1
- compress oversized prompt images at the ACP ingestion point with a
format gate, caption, and persisted originals; a cancel arriving
mid-compression settles the prompt as cancelled without a turn
- stream tool call args via tool.call.delta (lazy pending create,
cumulative replace, started upgrade) and refresh titles via
tool.progress status updates
- report compaction progress and results after /compact via the
compaction.* events
- answer unknown slash commands locally instead of sending them to the
model
- accept legacy "<id>,thinking" model ids and legacy approve /
approve_for_session approval option ids
- keep sessions without cwd metadata in cwd-filtered session/list
- sanitize wire errors: auth codes map to auth_required, turn.agent_busy
to invalid_request, everything else to a fixed internal-error message
- bump @agentclientprotocol/sdk to ^1.3.0
* fix(cli): drop stale registerServerCommand call and sherif ACP SDK split
- commands.ts called registerServerCommand, which no longer exists on
current main (the deprecated `kimi server` shim is registered via
registerWebCommand), breaking typecheck, build, and every CLI test
that builds the program
- sherif rejects the @agentclientprotocol/sdk major split between
acp-adapter (^0.23.0, production kimi acp) and acp-server (^1.3.0,
experimental); the two hosts legitimately target different SDK
majors, so ignore the dependency in the sherif invocation
* test: update fixtures for acp-v2 flag and domain rename, refresh nix deps hash
- kap-server origin.test: two CORS cases still used foo.com after the
whitelist moved to foo.example.com, so the origin was no longer
whitelisted and the expected CORS headers were withheld
- node-sdk config.test: expect the new acp-v2 experimental flag in the
harness feature metadata
- flake.nix: update the fetchPnpmDeps hash for the
@agentclientprotocol/sdk 1.3.0 lockfile change
* fix(acp): widen the ACP v2 auth gate beyond OAuth-only providers
The gate consulted only auth.summarize(), which iterates providers
declaring an oauth section — configurations that authenticate with a
plain apiKey or provider env-bag credentials (no OAuth at all) were
rejected with auth_required even though the default model is fully
usable.
- klient: expose authSummaryService.ensureReady on the global auth
facade (the contract already declared it)
- acp-server: gate on the engine's own readiness probe for the default
model — config apiKey / env-bag / OAuth token all count, matching how
the model is actually used — and fall back to "any logged-in OAuth
provider" (the legacy adapter's first branch)
- test: an apiKey-only config passes the gate with auth enforcement on;
the OAuth logout regression is unchanged
* fix(acp): reject concurrent prompts instead of displacing the in-flight turn
A second session/prompt while a turn is running overwrote the session's
only TurnDriver: the engine quietly queues plain prompts submitted
during an active turn (the launch resolves undefined, indistinguishable
from a hook-blocked launch), so the first prompt never settled and both
turns' events went unattributed.
Guard both model-bound launch paths (plain prompt and skill activation)
with a synchronous in-flight check and reject with invalid_request
(turn.agent_busy), matching the legacy adapter's busy semantics. Local
slash handling (builtins, unknown-command answers) is unaffected.
* feat(agent-core-v2): add tokenCounting service with strategy config and measured anchors
- add IAgentTokenCountingService as the single owner of token counts:
context size, full-request size, and estimate primitives, replacing
the scattered contextSize/tokenEstimate/fullCompaction paths
- add [token_counting] config section with strategy = measured+estimated
(default) / measured / estimated, plus the KIMI_TOKEN_COUNTING_STRATEGY
env override; measured zeroes all estimates, estimated ignores anchors
- keep a live measured-anchor ledger in TokenCountingModel: each LLM
exchange writes a real anchor, undo truncates the ledger so the
surviving prefix restores its REAL measured size instead of a
re-estimate, and compaction rebases to a single anchor that blends the
compaction exchange's measured summary output tokens
- skip writing an anchor when the stream reports no usage event instead
of anchoring emptyUsage() zeros, which zeroed the context size and
silenced compaction for providers without usage reporting
- return the strategy-resolved size (not measured) from rpc getContext
so the tokenCount contract stays correct under the estimated strategy
- migrate all consumers (contextMemory, fullCompaction, llmRequester,
rpc, mirrorAgentRun, sessionLegacy, kap-server legacyStatus, node-sdk,
kimi-inspect) to the new service; edge bridges no longer read the wire
model directly
- document [token_counting] and KIMI_TOKEN_COUNTING_STRATEGY in the
bilingual config reference
* fix(kap-server): omit maxContextTokens instead of pushing 0 when unknown
- readLegacyStatus falls back to the default model's context limit when no
model is bound, and omits maxContextTokens entirely when the limit is
unknown (0 is the engine's UNKNOWN_CAPABILITY marker, not a real limit)
- profileService no longer emits maxContextTokens in agent.status.updated
when the bound model alias does not resolve
* fix(agent-core-v2): resolve token_counting strategy only at the reporting edge
- keep measured anchors and heuristic estimates both recorded and feeding
internal logic (compaction triggers, budgets, overflow backoff) regardless
of the configured strategy
- add IAgentTokenCountingService.statusSize() as the single strategy-resolved
outward reading and route the WS/REST/RPC status surfaces through it
- fix the context-size display falling back to provider-reported usage under
the estimated strategy
- fix compaction overflow backoff retrying identical messages until failure
under the measured strategy (the strategy-gated estimator read as 0)
* feat(agent-core-v2): add AGENTS.md discovery reminder behind experimental flag
When a tool call touches a directory whose AGENTS.md was not part of the
injected instructions (the init-time load only covers the project-root to
cwd chain), append a system reminder to the tool result suggesting the
model read it, at most once per file per agent.
The new agentsMdReminder domain (Agent scope, gated by the
agents-md-reminder experimental flag, default off) hooks
toolExecutor.onDidExecuteTool: Read/Edit/Write contribute their path,
Glob/Grep their search root, and Bash its structured cwd plus literal
directory operands extracted from the command's syntax tree via the
in-repo bash parser (listing commands only, bare names, conservative
skips). Probing walks projectRoot to the touched dir with the same
candidate rules as the init-time load (shared helpers in
profile/context), skipping fully-known directories and blank files.
The known-set is seeded by profileService after each successful
bind/apply/refresh and by sessionInit after /init, claimed
synchronously per discovered file, and published as a whole value only
after the reminder is attached, so parallel calls never duplicate a
reminder and failures leave files eligible for the next touch.
* fix(agent-core-v2): keep the AGENTS.md reminder on visible results and seed restored agents
A same-step duplicate vetoed by toolDedupe carries a placeholder result
that the dedupe hook swaps for the original's deferred result; attaching
the reminder there discarded it while the file was already counted as
reminded, and the telemetry still claimed it was shown. Skip the
placeholder (the call id sits in toolDedupe.syntheticCallIds until the
dedupe hook consumes it) so the reminder, telemetry, and known-set only
advance on results that reach the model; the original call then carries
the reminder for both by the time the deferred resolves.
Session resume and forks commit an already-rendered system prompt
(AGENTS.md content included) without going through bind/apply/refresh,
so no seed point fired and the known-set lagged behind the injected
set, producing false "not part of the injected instructions"
reminders. The first qualifying call of a never-seeded agent now
re-runs the init-time discovery with the same inputs (agent cwd, os
home, brand home) and seeds from it, once per agent; a discovery
failure leaves the agent unseeded so the next touch retries.
* refactor(agent-core-v2): fold agentsMdReminder inline rationale into file headers
The package comment convention keeps rationale in the top-of-file block
only; move the inline blocks' unique increments there (hook-order
fallback mechanics, synthetic-key existence condition, frozen-vs-live
Bash base, operand-less vs failed-resolution listings) and derive
AGENTS_MD_BASENAMES from AGENTS_MD_PLAIN_NAMES so the candidate names
stay single-sourced.
* fix(agent-core-v2): use resolved accesses for AGENTS reminders
* feat(agent-core-v2): drop the agentsMdReminder experimental gate
* fix(agent-core-v2): harden AGENTS reminder tool outcomes
* fix(agent-core-v2): preserve actual tool execution outcomes
* Persist AGENTS.md paths across profile restoration
* test(agent-core-v2): update useProfile snapshot for agentsMdPaths
* fix(agent-core): replay v2 profile.bind records so resumed sessions keep their tools
Sessions created by the v2 engine (CLI 0.31+, wire protocol 1.5) persist
the profile binding, including the tool allowlist, as a profile.bind
record. The v1 replay path had no branch for it and silently dropped the
record, so a session resumed by a v1 host (e.g. the VS Code extension via
kimi-code-sdk) never called setActiveTools and sent requests with no
tools at all (observed server-side as tools_count=0; the model emits
reasoning only and stops with empty content).
v1 replay now maps profile.bind onto config.update + setActiveTools when
activeToolNames is an array, skips the record otherwise so the
resume-time default-profile fallback still applies, and treats
tools.reset_active_tools as a no-op.
* fix(vis): handle v2 profile records in context projection
* fix(agent-core): avoid synthetic replay for v2 profile binds
* fix(vis): render v2 profile wire records
* feat(config): add deprecation mechanism and rename loop retry limit
- agent-core-v2 config: declarative section `deprecations` (deprecated TOML
keys are ignored and report a warning diagnostic; the file is never
rewritten) and env binding `deprecatedEnv` (old var still resolves as a
fallback with a warning), surfaced via the new
`IConfigService.onDidChangeDiagnostics` event
- loop_control: rename `max_retries_per_step` to `max_attempts_per_step` and
`KIMI_LOOP_MAX_RETRIES_PER_STEP` to `KIMI_LOOP_MAX_ATTEMPTS_PER_STEP`;
`max_steps_per_run` moves onto the same mechanism (no longer silently
mapped)
- kap-server: push the global `event.config.warning` WS event to every
connection whenever the config warning set changes
- TUI: show config diagnostics in warning yellow at startup instead of the
dim startup notice
- docs: config-files/env-vars (en+zh), regenerated config manifest, and the
agent-core-dev config guide
* feat(cli): validate config.toml against v2 section registry in doctor
- add v2/validate-config.ts: validate config.toml with the agent-core-v2
ConfigRegistry, reporting registered-section schema failures as errors
and unknown top-level keys / deprecated keys and env vars as non-fatal
warnings
- route `kimi doctor` config validation through the v2 validator when the
KIMI_CODE_EXPERIMENTAL_FLAG master switch is on (lazy dynamic import,
keeping the v2 module graph off the default path)
- let doctor checks surface non-fatal warning messages on OK results
* chore: downgrade loop-control changeset to patch
- move the v1 message protocol and projection out of the engine into
kap-server and delete the engine-side messageLegacy edge adapter
- add a shared message history loader that folds the main agent's wire
journal into full history across compactions, backing both the
messages routes and the snapshot endpoint
- drop the disk-reading SnapshotReader fast path; assemble snapshots
from engine services for cold and live sessions, removing the
KIMI_SNAPSHOT_READER, KIMI_SNAPSHOT_TIMEOUT_MS and
KIMI_SNAPSHOT_CACHE_LIMIT knobs
- collect persisted wire record rebuild helpers in the transcript
service
* feat(agent-core-v2): add lifecycle hook events and enrich hook payloads
New hook events:
- TurnStarted: fired from the turn.started bus event, covering queued
turns, stop-hook continuations, and background/system turns that
UserPromptSubmit misses
- UserPromptQueued: fired when a prompt cannot launch immediately,
carrying the queue length
- TaskStarted: fired from the existing task.started bus event, so
background tasks no longer only produce a completion-time Notification
- SessionHeartbeat: per-session 60s liveness beat, armed only when the
event has hooks registered, letting hook consumers distinguish a
session hanging on a long permission wait from a crashed one
Payload enrichment:
- client_type (host platform identity) on every event
- session_title on every session/agent-scoped event
- model and profile on SessionStart
- SessionEnd reason is now 'exit' or 'archive' instead of a hardcoded
'exit'
- SubagentStart/SubagentStop now carry session_id/cwd like every other
event
* fix(agent-core-v2): re-sync SessionHeartbeat timer on hook-index reloads
The heartbeat timer was armed once after the runner's initial load, so a
SessionHeartbeat hook contributed later by a plugin reload never produced
beats for existing sessions. The runner now exposes onDidReload (fired
after every index build), and the session adapter re-syncs on it: arming
when a heartbeat hook appears, disarming when none remains.
* fix(node-sdk): keep the v1 PluginInfo contract assignable with v2-only hook events
The v2 hook-event union is now a superset of v1's, which broke the
node-sdk type projection in two places:
- the klient contract's hookDefSchema rejected plugin manifests using
the new events (TurnStarted, UserPromptQueued, TaskStarted,
SessionHeartbeat) at validation time — accept them
- getPluginInfo returned the v2 PluginInfo where the SDK contract
promises the v1 shape — project manifest.hooks through the v1-known
event list (read from the legacy HookDefSchema), mirroring how the
config mapper drops domains v1 does not know
The "Already logged in. Model configuration refreshed." confirmation was
rendered with the default dim text color, so users easily missed it and
assumed /login did nothing. Render it with the theme's success color,
matching the success styling used by the login spinner's "✓ Logged in."
line.
Co-authored-by: Mira Bot <mira-bot@moonshot.cn>
The secondary_model section did not state whether spawned subagents are
forced onto the secondary model or only default to it, nor the full
override precedence. Make the semantics explicit in both locales:
- spawning resolves the model in order: explicit tool-call model ->
profile model_preference -> configured secondary model (default)
- the tool's model parameter accepts only "primary" / "secondary"
- "primary" means the model the main agent is currently running, not
necessarily default_model
- the user has no per-spawn switch; overriding is the main agent's
decision or a profile setting
Also unify secondary-model terminology and the [models] alias wording
across the config-files, agents, slash-commands, and env-vars pages.
* feat(agent-core-v2): add lifecycle ledger, dynamic registry, and cascade engine
- add `_base/lifecycle` Ledger: ordered registrations with strict reverse
serial teardown, sync/async dual-track disposers, uninterruptible rollback,
effect return forms, child ledgers, introspection tree, and teardown-reason
propagation
- delegate Disposable/DisposableStore/MutableDisposable, Scope.dispose, and
InstantiationService.dispose to the ledger; retire _constructionOrder
- ServiceCollection: entries carry uid/pinned/recipe, delete(), and a
per-token availability event; add provide/unprovide to IInstantiationService
- add a persistent dependency graph recording constructor-injection edges
with affectedSet/topo queries, plus a per-container cascade engine
(contagion teardown/rebuild transactions, five unit states, pending index,
abort hook, history ring); TestInstantiationService.set routes via provide
* fix(agent-core-v2): cascade instance replacements, tolerate abort rejections
- provide/unprovide of pre-materialized instances now runs as a cascade
transaction too, so live dependents are torn down and rebuilt instead of
holding a stale dependency; re-affirming the live instance stays a no-op
- a rejecting onWillCascade promise is logged and the cascade proceeds
(best-effort), matching the synchronous-throw handling
* feat(agent-core-v2): propagate cascades across scopes along instance edges
Implements the revised D9 (the firewall design was dropped): instance edges
are scope-tagged on both ends and point child -> parent only, the dependency
graph is shared by the whole scope tree, and each change runs as one
tree-wide transaction orchestrated by the submitting scope's engine —
contagion computed over the global graph, teardown in global reverse
topological order (deepest first), rebuild in global topological order, with
each scope's engine executing its own units. Descendant scopes dying
mid-transaction are skipped idempotently; the request queue, in-flight set,
and settle waiters are tree-shared so cross-tree transactions are serialized
by the orchestrator; shadowed tokens stay outside the contagion set.
* refactor(agent-core-v2): code all domain failure modes as Error2
- wrap bare throws across agent/session/app/workspace/os/wire/kosong/mcpCore domains in coded Error2, keeping messages verbatim and moving structured data into details with the original error as cause
- add new wire codes (agent.already_exists/already_running/not_a_subagent/not_owned/type_not_allowed/max_tokens_exceeded, task.limit_exceeded, cron.expression_invalid, web.invalid_url/private_address/fetch_failed, mcp.oauth_failed, skill.parse_failed/nested_too_deep, wire.migration_missing) to the protocol KimiErrorCode union and the kap-server zod schema; register shell.git_bash_not_found and session.plan_mode_invalid
- re-base domain error classes onto Error2 (SkillParseError, UnsupportedSkillTypeError, HostFolder*, AgentFileParseError, NestedSkillTooDeepError, AlreadyAuthorizedError, HttpFetchError) keeping class names and instanceof consumers intact
- convert caller-bug and unreachable guards outside _base to BugIndicatingError
- fix the agent tool's task-limit remap never firing by branching on the task.limit_exceeded code instead of a stale message string
* refactor(kosong): make ChatProviderError family born-coded via Error2
- move the provider/context code string constants to kosong/contract/errors.ts
and compute each class's wire code at construction (status code / finish reason)
- move sanitizeStatusErrorMessage to the contract and fold status details
(statusCode / requestId / traceId) into Error2 details at birth
- slim translateProviderError down to the abort guard plus the foreign-error
fallback; ProtocolErrors keeps registering the domain via re-exported constants
- update errors.md conventions and tests for the pass-through behavior
* feat(storage): add permission_denied and disk_full error codes
- extend StorageErrors with storage.permission_denied / storage.disk_full
(both non-retryable, with user-facing actions)
- map errno at the backend boundary in toStorageIoError: EACCES/EPERM,
ENOSPC, unexpected ENOENT → not_found, everything else io_failed; the
message now carries the mapped reason
- register the two codes in the KimiErrorCode protocol union and the
kap-server zod schema, and document the mapping in errors.md
* fix(protocol): mirror all KimiErrorCode values in kimiErrorCodeSchema
the zod enum lagged the type union by 35 codes (agent.*, os.fs.*,
os.process.*, storage.*, wire.*, skill/task/mcp/cron/web additions), so
protocol consumers could type the new codes but rejected them at runtime
validation; spotted by Codex review on #2552
When the remote models.dev catalog cannot be fetched, fall back to the
built-in catalog so CLI/TUI model selection keeps working offline or
under network failure. Import the shared helper via the #/utils alias.
* fix(web): restore chat code block styling after the markstream upgrade
markstream-vue 1.0.9 renders shiki code blocks through stream-diffs
(code-editor-container) instead of <pre>, and drives font size, line
height, and font family from monacoOptions applied as inline styles.
With only lineNumbers passed, blocks fell back to 12px/18px in the
inherited proportional UI font, and the pre/copy-button/content CSS
overrides in Markdown.vue no longer matched anything.
Pass fontSize/lineHeight/fontFamily/padding through codeBlockProps
monacoOptions (the only channel that reaches the shiki renderer),
retarget the dead overrides to code-block-shell-content and
code-action-btn, and hide the loading fallback's hardcoded line-number
gutter so the highlight upgrade no longer shifts layout.
* fix(web): keep code block metrics in sync
* fix(web): pin chat code font to 13px and align the loading fallback
Tying the code font size to the Appearance UI font size setting changed the
default rendering from the 13px design token to 14px and broke the 15/14/13
type scale; revert to the fixed token size. Keep the fallback ↔ settled
alignment: the restored monaco padding option feeds the fallback pre's
inline padding (12px, ignored by the shadow-root renderer), and a relative
1.65 line-height with !important beats the inline 1.5x default upstream
stamps on the fallback.
* chore(web): pin markstream-vue and its renderer stack to exact versions
The markstream family ships breaking rendering changes in patch releases
(1.0.8 swapped the code-block engine and renamed its DOM classes), so a
floating caret range hands merge control to upstream. Pin markstream-vue,
stream-diffs, stream-markdown and stream-monaco exactly — upgrades become
deliberate actions with a visual check, same posture as @chenglou/pretext
in the same file.
* feat(agent-core-v2): interruption reminder for user-cancelled turns
When the user interrupts a turn with Esc, append a durable
<system-reminder> (origin: injection/interruption) to the agent context
via a new loop aspect watching turn.ended, so the model learns the
previous turn was deliberately cut off. The marker persists to the
wire, replays on resume, stays hidden from transcripts, skips non-user
aborts and steer, and does not stack on repeated cancels.
Two supporting fixes:
- An aborted LLM stream now persists its accumulated partial
text/thinking as content.part loop events instead of dropping every
produced token; gated on the turn signal so retried or
step-cancelled attempts keep their partial output out of the record.
- The turn.cancel wire op carries an optional reason
('user_cancelled' | 'aborted') so cold readers can tell deliberate
interrupts from programmatic aborts. Goal-lifecycle cancels now pass
an explicit programmatic reason to keep that field honest.
* feat(transcript): mark user-cancelled turns with an interruption marker
Project the deliberate user interrupt onto the transcript timeline: the
live projector emits an 'interruption' marker when a turn ends with
interruptReason 'user_cancelled', and the cold fold consumes the
persisted turn.cancel reason into the same marker. Programmatic aborts
keep surfacing through their own outlets (errors, goal/task state), and
queued cancels that left no visible residue are skipped.
* fix(agent-core-v2): make user-turn cancellation idempotent and reconcile interruption reminders on restore
* fix(transcript): dedupe user-cancelled interruption markers by turn in the cold fold
* chore(agent-core-v2): regenerate state manifest after merging main
* refactor(agent-core-v2): split interruptionReminder out of the loop domain
The loop domain owns turn execution mechanics; whether an interrupted turn
should produce a model-visible reminder is a model-context policy. Move it
into its own L4 domain with its own wire model that cross-reduces the
loop's turn.cancel fact, and rename the op to interruptionReminder.recorded.
---------
Signed-off-by: Haozhe <yanghaozhe@moonshot.ai>
Co-authored-by: Haozhe <yanghaozhe@moonshot.ai>
* fix(agent-core-v2): resolve package self-references in check-import-boundaries
Imports spelled @moonshot-ai/agent-core-v2/<path> (the legal `./*` export
self-reference) were treated as external packages, letting kosong layer
violations through that spelling pass the checker.
* refactor(agent-core-v2): move host runtime args onto IBootstrapService
- Add HostArgs under BootstrapInput.args / IBootstrapService.args
(agentFiles, skillDirs, requestHeaders, displayName, replyStyleGuide),
mirroring VS Code's NativeParsedArgs on the environment service
- Remove the narrow per-domain runtime-options services and their seed
functions: IAgentCatalogRuntimeOptions, ISkillCatalogRuntimeOptions,
IHostIdentity
- Reduce IHostRequestHeaders to a pure kosong port contract and bridge it
from bootstrap args via a new app/kosongConfig adapter, keeping kosong
free of app-layer imports
- Pass host args through bootstrap() at the composition roots (kap-server,
v2 print CLI, node-sdk) instead of seeding services
- Persist SDK provider removal as one atomic multi-section config replace
* fix(config): persist provider refresh updates atomically
- expose atomic multi-section config replacement through klient and SDK
- stage provider removals before one atomic write in TUI refresh
- briefly drain startup refresh during shutdown
* feat(agent-core-v2): persist the terminal turn.ended wire record
- add a persisted turn.ended op (turnId, reason, error, durationMs)
dispatched from the loop's runTurn finally block, alongside the event
- fold the record back in the transcript cold rebuild: terminal state
(blocked folded into failed, mirroring the live wire edge), durationMs,
error message and endedAt; journals without the record keep the
grouping default
- restrict the test harness's snapshot waiters to emit entries so the
same-named wire record no longer shadows the turn.ended event
* chore(agent-core-v2): stabilize unique-symbol keys in the state manifest
The checker names a unique symbol key __@name@NNNN, where NNNN is a
compilation-global counter that shifts with unrelated type additions and
churns the generated manifest. Render the stable __@name form instead.
* fix(transcript): map turn.ended around hidden turns in the cold fold
RetryStepRequest opens a real engine turn with origin 'retry' but
contributes no context messages, and a queued-then-cancelled
reservation consumes an engine id without starting. Both make engine
turn ids drift from the grouping ordinals, so matching turn.ended by
ordinal could stamp a later visible turn with the wrong terminal state.
Replay the loop's turn-clock records (turn.prompt / turn.cancel) and
map engine ids to ordinals past the hidden ids; the hidden turns' own
end records map nowhere and are dropped.
* refactor(agent-core-v2): move workspace-domain internals into internal/ dirs
- move sessionLifecycle/addressing into internal/
- move workspaceFs errors/fsProcess/fsSearch/rgLocator/runRg into internal/
- move workspaceMcpConfig/config-loader into internal/
- update import paths in services, index.ts, and tests
* docs(agent-core-v2): strip non-header comments, make headers file-local
- remove all symbol JSDoc and inline // and /* */ comments under src/;
file-top header comments and directive comments (eslint, @ts-*) are kept
- rewrite file headers to describe only what the file itself does, dropping
references to other files and see-X / lives-in / consumed-by relationships
- no code changes
* refactor(agent-core-v2): remove the L0-L7 domain layering and its lint guard
- replace check-domain-layers.mjs with check-import-boundaries.mjs,
keeping only the v1-import ban and the kosong subtree rules
- rename the lint:domain package script to lint:imports
- drop the (Ln) layer label from every file-header identity line
- update AGENTS.md, package docs, and the agent-core-dev skill to match
* web: reorder default permission options in Agent settings
Align the Agent settings default-permission segmented control with the
Composer toolbar order, arranging modes from safest (manual) to most
permissive (auto).
* web: reorder mobile permission cycle from safest to most permissive
The mobile settings sheet still cycled manual → auto → yolo, jumping from
the safest mode straight to the most permissive one on a single tap. Align
the tap-to-cycle order with the Composer menu and Agent settings
(manual → yolo → auto).
* web: align permission risk colors with the Composer's progression
Both the desktop status panel and the mobile settings sheet mapped
yolo → danger and auto → warning, the inverse of the Composer menu
(yolo → warning, auto → danger). Since auto is the most permissive
mode, it should carry the danger color everywhere.
---------
Co-authored-by: qer <wbxl2000@outlook.com>
The Agent/AgentSwarm tool schemas always advertised a \`model\` choice
parameter, so the secondary-model concept entered the prompt even with
the experiment disabled. Gate the advertised JSON schema on the flag in
both engines: off (the default) drops the parameter, on keeps it, and
spawn-time resolution already falls back to the caller's model either
way.
Also scrub ambient KIMI_CODE_EXPERIMENTAL_* env vars in both packages'
vitest setup so flag-dependent tool schemas in llm.tools_snapshot stay
deterministic regardless of the developer shell.
* feat(kap-server): let fs:search resolve a workspace ref for draft sessions
- fs:search accepts a workspace id or absolute root in the session_id slot
so the @ file mention works before the session exists
- kimi-web searchFiles falls back to the active workspace id in draft state
* fix(agent-core-v2): report empty thinking level for unbound main agent
- sessionLegacyService.status returns thinking_level '' when the main
agent has no bound model (mirroring model: undefined), so clients
fall back to the catalog default instead of folding in the wire
model's 'off' zero value
- add regression test for a never-bound main agent status
- add web changesets: draft @ file mention, new-session thinking level
* perf(minidb): make text index rebuilds async and non-blocking
- TextIndex.build() yields to the event loop during tokenization and
batches postings writes (~1 MiB), so large rebuilds no longer
hard-block the host process
- writes landing mid-build are queued and replayed onto the new base at
swap time, keeping the rebuilt index exact
- PostingsFile.rebuildSync renamed to async rebuild with a synchronous
commit section (beforeRename hook + atomic rename)
- onCompacted hook is now awaited (sync or async); open-time compaction
runs in the background so open() returns without blocking on the
snapshot rewrite and postings rebuild
- compaction skips the postings rebuild when the index's write buffer is
clean (needsRebuild)
- createTextIndex registers before building so concurrent writes feed
the build queue; dropTextIndex throws while a build is in flight
* refactor(agent-core-v2): rename workspaceHandler to sessionLifecycle
- rename IWorkspaceHandlerService to ISessionLifecycleService and move
src/workspace/workspaceHandler/ to src/workspace/sessionLifecycle/;
update all consumers (gateway, sessionExport, sessionLegacy,
sessionLookup, kap-server, klient, node-sdk, kimi-inspect, kimi-code)
- rename IStateService to IAppStateService and add the Workspace-scope
IWorkspaceStateService, so the state domain spans all four scope tiers
- add cascading StateRegistry.inspect(): each tier injects the parent
tier's registry and folds App to current scope into one StateInspection
tree; check-domain-layers gains a Rule 2b exemption for state-on-state
imports
* feat(kap-server): add session-less POST /workspace/fs:search route
Carry the workspace reference (registered id or absolute root) in the
request body and resolve it to the same Workspace-scope fs service the
session route uses, so clients no longer borrow the session route's
{session_id} slot. kimi-web's @ file mention now calls this route with
the workspace ref instead of a session id; the session-route fallback
stays for wire compatibility.
* refactor(agent-core-v2): register workspace-scope service state into IWorkspaceStateService
- move workspaceDirs / workspaceInstructions / workspaceSkillCatalog / workspaceTrust
runtime state from bare instance fields into the workspace state container
- extend gen-state-manifest.mts to scan app/workspace scopes, emitting
AppStateSnapshot / WorkspaceStateSnapshot alongside Session/Agent
- regenerate docs/state-manifest.d.ts and update AGENTS.md + agent-core-dev skill
- update affected tests to register the state services and assert the new state keys
* feat(agent-core-v2): insert Workspace lifecycle scope and remove mutable cwd paths
- Insert LifecycleScope.Workspace between App and Session
- Delete session/workspaceCommand domain (addAdditionalDir) and node-sdk RPC
- Remove profile cwd mutation; cwd is fixed at creation
- Make ISessionWorkspaceContext read-only; seed additionalDirs at creation
- Remove TUI and vscode /add-dir commands (to return workspace-scoped)
* feat(agent-core-v2): add Workspace scope with handler-owned session lifecycle
- Add IWorkspaceLifecycleService (App scope): handler registry,
create-or-get handlerFor with inflight join
- Add workspace/workspaceContext seed and workspace/workspaceHandler
(session create/resume/fork as handler child scopes)
- Delete App-level ISessionLifecycleService; callers compose
index -> handlerFor -> handler via sessionLookup helpers
- Slim IBootstrapService; persistence addressing via handler chain
(disk layout byte-identical)
- kap-server routes rewire internally; /api/v1 wire unchanged,
debug surface gains workspace addressing
- Pin red line in domain lint: session/agent must not import
workspace domains
* feat(agent-core-v2): collect workspace resources into the handler scope
- Add Workspace-scope catalogs for skills and agent profiles,
instructions service, and a shared MCP connection manager
(built at materialization, refreshed by watch/plugin events)
- Session catalogs keep their APIs but read seeded snapshots and
refresh via change events; ISessionMcpService removed
- Session create options carry no mcpServers; MCP sources are
config file (wins on name conflicts) and plugins only
- Agent profile/mcp consume the seeded providers
* feat(agent-core-v2): restore add-dir as a workspace-level capability
- Add workspace/workspaceDirs: shared additional-dir set with
addDir({path, persist}); persist=true writes .kimi-code/local.toml,
local.toml watch drives cross-process refresh
- ISessionWorkspaceContext becomes a live read view fed by the
ISessionWorkspaceInfo seed contract and change events
- Restore Session.addAdditionalDir in kimi-code-sdk 1:1, mapping to
the workspace service; restore TUI/vscode /add-dir verbatim
* feat(agent-core-v2): collect os-level services into the workspace scope
- Move fs service, fs watch (shared subscription fan-out), process
runner, and a git facade to Workspace scope; sessionFs domain removed
- Add IWorkspaceToolPolicy with workspace veto wired through tool
activation, execution guard, composed evaluation, and profile
prompt projection; injected via ISessionToolPolicyGate seed
- kap-server fs routes and fs.watch bridge remap to the workspace
services; wire unchanged
* refactor(agent-core-v2): clean up workspace-domain leftovers and docs
- Drop dead code: v2 mergeCallerMcpServers, the transitional
ISessionContext.additionalDirs field, an unreachable guard
- Fix stale domain references in comments; correct test names
- Give the fs-watch refresh test a realistic wait budget under load
- Document the four-scope model and workspace domain in AGENTS.md,
agent-core-v2 docs, and the agent-core-dev skill
* test(node-sdk): wait for the initial MCP connect to settle in the parity list test
v1 connects in the background after create resolves while v2 awaits it
inside create, so an immediate list can catch either side still pending
under CI load
* refactor(agent-core-v2): extract git work-tree discovery into the git domain
- add the pure findGitWorkTree probe in app/git/workTree and expose it
as IGitService.findWorkTree
- switch the git permission policies off the local
findLocalGitWorkTreeMarker helper to the DI service
- reuse findGitWorkTree for AGENTS.md project-root discovery in
agent/profile/context.ts
- add findWorkTree coverage to gitService.test.ts
* feat(kimi-inspect): add Workspace Services view
- add WorkspaceServicesView rail view with a workspace picker on top;
proxies resolve workspace-scope Services on the /workspace/:id route
- extend ChannelScope, ServiceTarget, and ServicePanelDef scope with
'workspace', routed via client.workspace(id).service
- wire the new view into NavRail and App
* refactor(agent-core-v2): extract mcpCore and workspaceMcpConfig domains
- move the scope-agnostic MCP connection layer (stdio/http/sse clients,
connection manager, oauth, config schema, tool naming) from agent/mcp
to the new mcpCore domain
- move the [mcp] config section to app/mcpConfig and OAuth credential
persistence to app/mcpConfig/oauthStore
- introduce the workspace/workspaceMcpConfig domain owning the effective
MCP server set (mcp.json files + plugin contributions, refreshed by
fs watch); workspaceMcp keeps pure connection orchestration
- update the plugin domain, session MCP handle, klient/node-sdk
contracts, and tests accordingly
* refactor(agent-core-v2): remove the fault-injection experimental feature
- delete the faultInjection domain (flag definition, IFaultInjectionService
contract, FaultInjectionService implementation)
- drop the requester-side take() injection point and the constructor
dependency from llmRequester
- remove the flag-gated test cases and the IFlagService stub they needed
- regenerate the state manifest without the faultInjection state keys
* feat(agent-core-v2): gate project-level MCP config behind workspace trust
Add the Workspace-scope IWorkspaceTrust service: an explicit, per-workspace
trust marker persisted under the home (IAtomicDocumentStore, keyed by
encodeWorkDirKey(root)) so a checked-out tree cannot pre-trust itself.
While a workspace is untrusted, workspaceMcpConfig skips the project-level
.mcp.json and .kimi-code/mcp.json files (user-level config and plugin
contributions still load); a trust flip reuses the reload path, so project
servers connect on trust and disconnect on untrust.
Expose the state over kap-server REST: GET /workspaces/{id}/trust,
POST /workspaces/{id}/trust, POST /workspaces/{id}/untrust.
* feat(kimi-inspect): replace the workspace picker with a directory browser
The Workspace Services view now keeps a server-side directory browser in a
left sidebar (over IHostFolderBrowser) instead of a <select> of registered
workspaces. Entries that are registered workspaces carry a workspace badge
plus their IWorkspaceTrust trust state; selecting an unregistered folder
registers it on demand via IWorkspaceService.createOrTouch.
* fix(agent-core-v2): resolve the effective cwd into the profile binding
A default-bound agent recorded no cwd in its profile.bind payload, and no
caller configures ProfileServiceOptions.cwd, so the profile service's cwd
getter fell through to '' and refreshSystemPrompt() rebuilt the prompt
from the server process's cwd: an AGENTS.md edit dropped the workspace
instructions (or swapped in unrelated ones).
bind() now persists the resolved effective cwd (the input's, or the
session's when the input omits it) into profile.bind — the Model's cwd
stays creation-fixed and is always set. The getter's last resort is the
session's own cwd (the value legacy bindings resolved against) instead of
a bare ''.
* refactor(agent-core-v2): introduce the contribution/registry/catalog extension point for agent profiles
- App-scope IAgentProfileRegistry: any scope can register an
AgentProfileContribution keyed by (sourceId, workspaceKey); dedup per
source id, change events drive catalog re-projection
- workspaceAgentProfileLoader domain owns agent-file discovery end to end
(parse / roots / SYSTEM.md / explicit runtime files) with five
Workspace-scope loaders (workspace / user / plugin / extra / explicit)
tagged with the handler's workspaceId; internals live under internal/
- SessionAgentProfileCatalog projects the registry directly (name dedup,
priority adjudication, builtin override rule, inspect()); the
workspace-catalog + sessionData seed relay is gone
- builtin code contributions register as the 'builtin' entry via
BuiltinAgentProfileLoader; plugin agent roots are provided by the
plugin domain as PluginAgentRoot
- remove cwd from the profile binding chain (BindAgentInput /
ProfileBindingSnapshot / AgentConfigData / ProfileModelState /
profile.bind op) — it is always the session's frozen cwd; legacy
wire.jsonl records replay fine (the schema strips the field)
- share markdown frontmatter parsing via _base/text/frontmatter
* fix(agent-core-v2): reconcile the workspace refactor with main
- restore the branch's klient workspaceId scope extension lost to a
file-level conflict resolution (main had no further changes there)
- stub the plugin system-prompt dependencies main added to the profile
service in the profileOps / skillCatalog tests
- correct PLUGIN_SKILL_SOURCE_ID to the App skillSource domain (Agent
scope must not import the Workspace domain)
- kap-server workspaceLayout test supplies the now-required hostIdentity
- regenerate wire/state/config manifests
* fix(agent-core-v2): export the agent-file parse primitives the v2 print CLI consumes
The internal/ split kept parseAgentFileText / resolveAgentPath off the
package entry, but apps/kimi-code's v2 print runner imports them from
@moonshot-ai/agent-core-v2 for --agent-file. Export the two symbols by
name; everything else under internal/ stays domain-private.
* feat(agent-core-v2): return cwd listing for empty fs:search query
An empty fs:search query used to fail request validation (query had a
minimum length of 1), so @-mention pickers had no starting set right
after typing "@". The workspace fs service now answers an empty query
with the workspace root's top-level entries — directories first,
hidden entries excluded, gitignore and exclude_globs honored — mapped
into the search-hit shape (score 1, empty match positions) and capped
by limit. The mirrored protocol wire schema is relaxed in sync.
* test: cover cron-fired steer context and titled session creation
- agent-core-v2: e2e asserting a cron-fired steer turn carries earlier
tool results (the CronCreate job id) into the provider request
- klient: conformance case creating a titled session through implicit
workspace materialization
* fix(agent-core-v2): write refresh results in one atomic config transition
- add IConfigService.replaceSections: applies several domains in a single
state transition — one disk write, one effective rebuild, change events
fire only after all domains took effect
- rework ProviderDiscoveryService to absorb the orchestrator's two-phase
removeProvider/setConfig host contract into one replaceSections write, so
the kosong registries never pass through a halfway-removed catalog
- stop writing the env-synthesized __kimi_env__ slice to config; the
bridge's event-driven sync carries it into the registries on its own
- fixes sporadic "model is not configured" errors when starting kimi web,
caused by the background refresh transiently clearing the model catalog
while the first session was being created
* fix(agent-core-v2): stage replaceSections writes before mutating raw config
Validate and strip every domain into a staged copy of the raw/memory layer
first, then swap it in only after the whole batch succeeds — previously a
later domain failing validation left earlier domains already applied to
this.raw/this.memory while the call reported failure, exposing a partially
applied user layer to inspect() and future merges.
* feat(kap-server): expose the managed-account profile at GET /oauth/userinfo
* refactor(oauth): serve the userinfo profile as the camelCase domain type end to end
* style(agent-core-v2): drop the method-local comment on getManagedUserInfo
* chore: drop the userinfo endpoint changeset
* test(kap-server): pass the required host identity in the userinfo route test
- delete the faultInjection domain (IFaultInjectionService, its Agent-scope
implementation, and the fault-injection experimental flag)
- drop the llmRequester's per-attempt fault consumption point and the
faultToError helper
- remove the fault-injection test cases and DI wiring from the requester
service tests, and the domain's layer-registry entry
- regenerate the state manifest without the faultInjection.* state keys
* fix(agent-core-v2): treat cache entries missing required fields as cold misses
- normalize `archived` to a boolean when mirroring session metadata to the
read model, so entries for pre-`archived` sessions no longer lose the key
during JSON serialization
- add a runtime shape check on read-model cache hits; entries missing
required fields are rebuilt from disk and overwritten, self-healing
poisoned entries written before the fix
- log a warning when the TUI session picker fails to fetch sessions instead
of silently showing "No sessions found."
* chore: add changeset for session index cold-miss fix
* refactor(oauth): make X-Msh-Platform an explicit host identity field
X-Msh-Platform was hardcoded to kimi_code_cli in createKimiDeviceHeaders,
so non-CLI hosts could not state their own platform and the desktop had
to patch the header after the fact. KimiHostIdentity now carries a
required platform (every host declares its own value; the CLI constant
stays the fallback only for direct createKimiDeviceHeaders callers), and
userAgentProduct is renamed to productName so the transport identity
uses one name everywhere.
All in-repo identity constructions pass platform explicitly; the wire
value for CLI and VS Code hosts is unchanged (kimi_code_cli).
* feat(agent-core-v2): carry the host identity in the bootstrap snapshot
Replace the flat clientVersion field with a required clientIdentity
(KimiHostIdentity) so every consumer reads the same host identity
object: OAuthToolkitService now passes it to the OAuth toolkit, which
means the OAuth device-flow endpoints (device authorization, token
polling, refresh) on the kap-server path finally send the full X-Msh-*
device headers instead of none, and the telemetry cloud appender reads
client_version from the same source. A built-in CLI fallback keeps bare
bootstrap() calls in tests working; composition roots must pass their
own identity.
The session export manifest grows an optional desktopVersion field
(payload plumbed through; filled by kap-server in a follow-up).
* feat(agent-core): thread the host identity into the managed auth facades
The v1 managed auth facade constructed its OAuth toolkit without an
identity, so token refreshes from inside the core went out without any
X-Msh-* device headers. createManagedAuthFacade now takes an optional
KimiHostIdentity and every call site supplies one:
CoreProcessService._defaultOAuthTokenResolver forwards the core
process's options.identity (the same source _defaultKimiRequestHeaders
uses), and the DI-held services (oauth / auth summary / model catalog)
read it from a new optional identity field on IEnvironmentService. The
library-level "no identity, no device headers" contract is unchanged.
* feat(kap-server)!: require the host identity and derive request headers from it
ServerStartOptions.hostIdentity is now a required ServerHostIdentity
(KimiHostIdentity + optional prompt display fields), replacing both the
old optional HostIdentityOverrides (renamed to PromptIdentityOverrides,
its productName field now displayName) and the version option (renamed
to serverVersion — it is the engine version reported as server_version,
while the host product version travels in hostIdentity.version).
The server now feeds bootstrap's clientIdentity from hostIdentity and
derives the default outbound headers (User-Agent + X-Msh-*) from it via
createKimiDefaultHeaders, so kap-server-hosted OAuth flows and model /
WebSearch requests carry the real host identity instead of a hardcoded
kimi-code-cli fallback UA. Explicit header seeds still win as an escape
hatch.
Session export manifests record the host product version: kimiCodeVersion
now carries hostIdentity.version (the engine version no longer appears),
and desktop exports (desktop: true) are additionally stamped with a
desktopVersion field. The instance registry keeps its host_version wire
field for compatibility (kimi-inspect reads it); only the in-memory name
changed to serverVersion.
* feat(cli): wire the CLI host identity into the kimi web server
kimi web now passes createKimiCodeHostIdentity(version) as the server's
hostIdentity, so web-UI OAuth flows and the engine's outbound requests
carry the explicit CLI identity (productName + version + platform). The
explicit hostRequestHeadersSeed is dropped — kap-server derives the same
headers from hostIdentity — and buildKimiDefaultHeaders goes away with
its only consumer.
* test(klient): drop clientVersion from the bootstrap contract parity list
* chore: add changesets for the host identity unification
* feat(cli): tag kimi web requests with a (web) User-Agent suffix
kimi web shares the CLI product token and platform, so its outbound
requests were indistinguishable from direct CLI runs upstream. Its host
identity now carries userAgentSuffix 'web', putting web-UI traffic at
kimi-code-cli/<version> (web) while X-Msh-Platform stays kimi_code_cli.
* fix(klient): keep the env() clientVersion wire field after the bootstrap identity switch
The bootstrap snapshot replaced the flat clientVersion scalar with
clientIdentity, which broke klient's env() fan-out (RPCError: method not
found). The wire surface keeps clientVersion — now sourced from
clientIdentity.version — and bootstrapService gains a clientIdentity
read (registered in envContract with an object schema) for consumers
that want the full identity.
* feat(oauth): send the product User-Agent on OAuth requests
The OAuth endpoints used to receive only the X-Msh-* device headers
(undici's default UA otherwise), which left the OAuth host unable to
distinguish runtime surfaces — notably kimi web, whose platform matches
the CLI and whose only distinguishing mark is the (web) UA suffix. The
toolkit now feeds the full identity headers (User-Agent + X-Msh-*) into
every device authorization, token polling, and refresh request; the
request-header type widens from DeviceHeaders to OAuthRequestHeaders.
* feat(vscode): report kimi_code_vscode as the extension's platform
The VS Code extension inherited the CLI's hardcoded X-Msh-Platform value;
with platform now an explicit identity field it declares its own, so the
managed endpoints and OAuth host can tell extension traffic apart from
CLI runs.
* refactor(agent-core-v2)!: require the client identity at the composition root
The bootstrap fallback identity fabricated a kimi-code-cli/unknown host
for any caller that forgot to pass one — the same silent-misreport
pattern this series set out to remove, and it made "required" a lie.
BootstrapInput.clientIdentity is now required, so a missing identity
fails at compile time instead of being papered over. Test and example
callers pass a shared fixture (klient examples and test engines get one
each); the node-sdk v2 client asserts its host identity with the oauth
helper. Also folds DeviceHeaders from an interface into a type alias so
it stays assignable to the widened OAuthRequestHeaders record.
* feat(oauth)!: require and validate the platform in device headers
Drops the quiet CLI fallback in createKimiDeviceHeaders (the same
silent-misreport pattern removed from the bootstrap identity): platform
is now a required option, validated with the same required-ASCII rule as
the version — empty or all-non-ASCII values throw instead of emitting a
blank X-Msh-Platform, and header-unsafe characters are stripped rather
than sent raw.
* fix(node-sdk): seed the host request headers on the v2 client path
The interactive v2 engine path (experimental flag) bootstrapped without
a hostRequestHeaders seed, so managed vendor calls went out with the
SDK's default User-Agent (OpenAI/JS) and no X-Msh-* at all — v1 passes
the full identity headers on the same requests. The v2 client now seeds
the headers from its asserted host identity, and a test pins the seed.
* chore: simplify the CLI changeset wording
* fix: remove the blocking wait from the TaskOutput tool
The block/timeout parameters let a model stall the whole turn waiting
for a background task (up to 3600s), even though completion already
arrives via automatic notification. Remove both parameters from the v1
and v2 engines (kept in model-facing parity), simplify retrieval_status
to success/not_ready, and update the tool, Bash, and Agent prompt
wording plus user docs accordingly. Stale callers passing block are
silently treated as a non-blocking snapshot.
* fix: align background-task prompts with the non-blocking TaskOutput
The compaction reminder promised TaskOutput could fetch a task's result
for tasks that are still running, where it now returns not_ready —
reword it to snapshot semantics and point at the completion
notification. Also list AskUserQuestion(background=true) as a task
source in the TaskOutput description.
* test: exercise stale TaskOutput args through the runtime validator
A stale block/timeout argument never reaches the tool: the executor's
preflight validates args against the closed tool schema and rejects
them immediately, so the old test documented silent-tolerance semantics
the runtime never exhibits. Assert the real behavior through
compileToolArgsValidator/validateToolArgs instead, and drop
statement-adjacent comments to match the package's header-only comment
convention.
* feat(agent-core-v2): let plugins contribute system prompt instructions via the manifest systemPrompt field
* feat(agent-core-v2): add systemPromptPath to load plugin system prompt from a file
* docs: explain plugin system prompt templates
* fix(agent-core-v2): refresh plugin system prompts after changes
* fix(agent-core-v2): freeze restored profile bindings and converge plugin contributions at session scope
- restore no longer re-renders or re-persists prompts: a resumed agent
keeps its replayed profile binding (prompt and tool set) as persisted
- a new Session-level convergence point reloads plugin skills into the
session skill catalog before fanning out to every live agent prompt,
and every catalog-kind plugin mutation awaits the whole pipeline;
MCP-only toggles carry a distinct change kind and skip it
- live refreshes after a restart re-resolve the bound profile by name
and rebind the full slice (prompt, disallowed tools, active tools)
atomically, warning and keeping the persisted state when the profile
is gone; renders reuse the first-render timestamp and unchanged
prompts are not re-persisted, so convergence never churns the wire
- cap plugin system-prompt contributions (32 KB per field/file, 64 KB
aggregate per prompt build) with manifest diagnostics and warnings
- bump the changeset to minor: this is a new user-facing capability
* fix(agent-core-v2): register the new session domain and dedupe the missing-profile warning
- add sessionPluginContribution to the domain-layer registry so
lint:domain stays green
- emit system-prompt-refresh-profile-missing once per profile name,
matching the service's other deduped warnings
- document the convergence timeout escape hatch and the klient
exclusion of enabledSystemPrompts
* fix(agent-core-v2): dedupe the plugin budget warning and surface section read failures
- emit plugin-sections-oversized once per skipped-plugin signature
- let enabledSystemPrompts failures propagate to the refresh catch
(keeps the current prompt and warns) instead of silently rendering
and persisting a prompt without plugin instructions
- cover the convergence timeout cut-off with a fake-timers test
- clarify that the first-render timestamp anchors per process
* fix(agent-core-v2): serialize session convergence and restore onDidReload timing
- run at most one convergence per session and bound each change's wait
by the timeout, so a fan-out emitter never interleaves deliveries
after a timed-out convergence
- fire onDidReload as soon as the reload commits again, keeping hook
reloads independent of prompt convergence
- sign the plugin budget warning with an unambiguous key
* docs(agent-core-v2): align convergence wording with the serialized semantics
- the timeout retry promise only holds once stalled work clears
- note the per-session serial delivery cost model on the plugin change
contract and the dual-queue invariant on the service
* fix(agent-core-v2): keep empty plugin sections byte-neutral in the prompt template
- place ${plugin_sections} on the same template line as
${skills_section} so prompts without either block render exactly as
before this feature
- note on the change contract that waitUntil work must not call back
into plugin mutations, and spell out the per-session convergence
order in the user docs
* fix(agent-core-v2): pin a fork's profile so refresh triggers never rebind it
- applyBindingSnapshot left the fork with no pinned profile, which
routed in-process forks into the post-restart catalog rebind and
could reset an inherited tool set; forks now inherit the source
agent's pinned profile object
- pin the first-render timestamp reuse with a ${now}-embedding test
and document the anchored ${now} semantics
- tighten the plugin docs budget and resume-refresh wording
* fix(agent-core-v2): join in-flight convergence during agent bootstrap
- an agent created while a plugin convergence is in flight now waits
for it, and a restored agent refreshes once after it, so a plugin
mutation never straddles an agent's bootstrap
- warn on a non-string systemPrompt field and strip a UTF-8 BOM from
systemPromptPath files before trimming
- correct the consumption-surface wording (every CLI surface on the
experimental flag, not just kimi -p), the per-session queueing note,
and the single-plugin combined budget clause
* fix(agent-core-v2): bound the bootstrap convergence join by the timeout
A permanently wedged convergence kept convergeTail pending forever,
and the unconditional settled() wait in bindBootstrap would have
blocked every later agent creation in that session; the join now
races the shared convergence timeout and continues (a restored agent
still refreshes once, which never touches the tail), and the timeout
constant moves to the contract for reuse
* fix(agent-core-v2): close the convergence race against in-progress restores
- a convergence fan-out could land while an agent's wire log is still
replaying, dispatching a replay-visible config record whose effect
the rest of the replay then overwrites; refreshSystemPrompt now
skips while the wire restore is in progress
- convergence completion is tracked by a generation counter; bootstrap
compares it (after a bounded join) and refreshes a restored agent
exactly once when a round completed after its creation began,
replacing the wasConverging flag that could miss both windows
* fix(agent-core-v2): bound each convergence so a wedged participant cannot stop the pipeline
- the fan-out now races the convergence timeout, so convergeTail always
settles: a permanently hung refresh delays its round (blocked entries
drain oldest-first on later changes) instead of killing the session's
convergence for good
- warn when agent bootstrap stops waiting on a stalled convergence
- diagnose a blank systemPromptPath and pin the plugin-root escape
guard with traversal, absolute-path, and symlink tests
* fix(agent-core-v2): bound the skill reload, preserve user-tool overlays, roll the prompt clock daily
- the convergence's skill-reload segment now races the same timeout as
the fan-out, so no segment of the pipeline can wedge a session for
good; it continues with the previous catalog and retries next change
- a cold rebind that resets the tool set replays session-added user
tools onto the new base instead of dropping them for the rest of the
process
- the rendered timestamp re-anchors when the UTC date rolls over, so
long-lived processes keep a fresh clock while steady-state renders
stay byte-stable within a day
- the plugin budget warning dedupes per plugin id, and the docs note
that systemPromptPath content is frozen until the next reload
* feat(agent-core-v2): converge cold plugin changes on resume through a drift-free gate
- restore replays the persisted binding untouched, then bootstrap
refreshes only when drift-free inputs changed while the session was
cold: the catalog profile's tool set/denylist, or the plugin-sections
baseline persisted alongside the prompt on the existing bind/update
payloads; directory-listing and date drift wait for live triggers,
so quiet resumes append no replay-visible records
- the rendered timestamp is day-precision (UTC date at 00:00,
re-anchored on rollover), keeping steady-state renders byte-stable
across resumes and sessions on the same day
- consolidate both timeout helpers onto a shared raceOutcome, and drop
the generation counter the gate supersedes
- align the plugin-sections precedence prose with the AGENTS.md
disclaimer (no self-granted authority, system instructions win on
conflict)
* fix(agent-core-v2): bound the restored-prompt gate and land the sections baseline
- the gate's plugin-sections read now races the convergence timeout, so
agent creation never blocks behind an unrelated plugin mutation
- refreshes serialize per agent through a tail, so overlapping triggers
cannot write prompts out of order
- when plugin sections change but a plugin-free custom prompt does not,
the new baseline lands as a sections-only update instead of making
every later resume re-render in vain
- align the system prompt's Date and Time paragraph with the
day-precision anchored timestamp
* Update plugin system-prompt instructions in changeset
Live sessions pick up plugin changes, while the default TUI and `kimi -p` paths ignore these fields.
Signed-off-by: 7Sageer <sag77r@hotmail.com>
* refactor(agent-core-v2): keep plugin skill reload user-driven
Plugin mutations still converge live agent prompts, but the session
skill catalog goes back to refreshing only on explicit plugin reload,
as before: the prompt feature does not need skill convergence, and the
pre-existing manual-reload semantics stay uniform across all plugin
contributions. Removes the convergence-driven skill reload, the
reloadSource de-privatization, and their tests; restores the
PluginSkillSource onDidReload forwarding and its catalog tests.
* refactor(agent-core-v2): apply plugin system-prompt changes only on explicit reload
Drop the live convergence machinery (the plugin onDidChange barrier,
the sessionPluginContribution fan-out, the restored-prompt drift gate,
and the day-precision render clock) so plugin system-prompt sections
take effect at the same point as every other plugin contribution:
/plugins reload or a new session. The profile now refreshes when the
session skill catalog re-pulls its plugin source on reload, reading
both the skill list and the prompt sections fresh.
* feat(agent-core): let plugins contribute system prompt instructions via the manifest systemPrompt field
* chore(agent-core-v2): remove inline implementation comment
* docs: clarify plugin prompt refresh semantics
---------
Signed-off-by: 7Sageer <sag77r@hotmail.com>
isImageFormatError missed the production phrasing "Unsupported image.
Please try another one." — the existing pattern requires a url/format/
type suffix, so the deterministic image rejection never triggered the
media-stripped resend, and the session failed on every later request.
Add a standalone-sentence pattern (punctuation- or end-terminated) to
both the kosong and agent-core-v2 classifiers, keeping the deliberate
boundary that count/size phrasings must not match.
Co-authored-by: fengchenchen <fengchenchen@moonshot.ai>
* docs: fix dead anchor links in en/zh docs
- #loop_control -> #loop-control (heading slug uses hyphens)
- #secondary_model -> #secondary-model
- env-vars model section anchors: kimi_model -> kimi-model
- provider credential section anchors: configtoml -> config-toml
- /provider management anchors: point at the renamed heading in each locale
- hooks: point the stale config-files#hooks reference at the local Configuration section
- en files: replace two leftover Chinese anchors with their English targets
* docs: add missing .md extension to themes page links
---------
Co-authored-by: qer <wbxl2000@outlook.com>
* test(node-sdk): drop v1-only subagentNames from the resume parity projection
Custom agent files made v1's resumed agent config carry the bound
profile's delegatable subagent roster; v2's resumed agent state has no
equivalent field, so the resume parity cases fail on main. Project the
engine-owned field away instead of pinning it as a resume-data gap.
* fix(node-sdk): wire applyPersistedSecondaryModel to agent-core-v2
On the v2 engine route the /secondary_model command persisted the recipe
but failed to apply it to the current session: the SDK method fell
through to the base class's not_implemented getRpc().
v1 pushes a reloaded config snapshot into the session because its spawn
binding, tool descriptions, and cached startup warning all read that
snapshot. agent-core-v2 resolves the secondary model live against
IConfigService at spawn time and rebuilds the tool description per read,
so the setConfig write already takes effect session-wide. The override
keeps the rest of v1's contract: config reload, the same loud
validations (session lookup, persist-first recipe check, pointed-model
resolution wrapped at [secondary_model].model), and a warning-cache
refresh via a new recheckSecondaryModelWarning on the session warning
service. getSessionWarnings also surfaces the v2 secondary-model warning
next to the AGENTS.md one, matching v1's aggregate.
* fix(agent-core-v2): surface the subagent's bound model on status events
The v2 model slice rides only the bind-time agent.status.updated, which
precedes subagent.spawned and is dropped by clients that key child events
off the spawn, so subagent cards never learned the model — and a
single-step run emits no usage/context slice until it ends, so the model
only appeared at completion. Re-affirm the binding right after the spawn
announcement via a new IAgentProfileService.republishStatus, and fold a
consistent usage/context/model snapshot into every status event at both
v1 edges (kap-server's broadcaster and the in-process SDK session
wiring, resolving the secondary-model derived id to a readable display
name.
EOF
)
* Delete .changeset/subagent-card-model.md
Signed-off-by: 7Sageer <sag77r@hotmail.com>
* style(agent-core-v2): remove inline implementation comments
---------
Signed-off-by: 7Sageer <sag77r@hotmail.com>
