* feat(agent-core-v2): remove Agent and AgentSwarm from builtin profile tool lists
The builtin agent and coder profiles no longer expose the Agent and
AgentSwarm tools, so sessions on the v2 engine do not offer subagent
delegation by default. The tools themselves remain registered; profiles
that list them explicitly can still opt in.
* feat(agent-core): remove Agent and AgentSwarm from builtin profile tool lists
Align the v1 builtin agent/coder profiles with the v2 change: the
default profiles no longer offer subagent delegation, while the tools
stay registered for profiles that list them explicitly.
The parity projection drops v1's inactive Agent/AgentSwarm roster
entries: v1 reports registered-but-inactive builtin tools where v2 only
registers the tools a profile lists, so an inactive entry has no v2
counterpart. Active entries still compare in full.
* fix: keep Agent and AgentSwarm in the builtin agent profile
Scope the removal to the coder subagent profile on both engines: the
main agent keeps Agent/AgentSwarm so default sessions can still
delegate, while coder subagents no longer spawn nested subagents by
default. Snapshots and token counts shift only for the embedded coder
tool list; the v1 parity projection needs no change since the main
agent rosters match again.
* feat(kimi-code): show step retry progress in the activity indicator
Wire the engine's turn.step.retrying event into the TUI: while a failed
model request is backing off for another attempt, the waiting spinner
shows 'retrying (N/M) · errorName · in Xs' with a dim detail line for
the status code and provider error message, and the loading tip is
suppressed.
The retry state clears on the step's terminal events (completed /
interrupted), turn.ended, and tool.result. It intentionally survives
turn.step.started because the v2 engine re-emits that event for every
retried attempt of the same step.
* fix(kimi-code): show the retry indicator for mid-stream failures
A retryable failure raised after thinking/assistant deltas had already
streamed left the pane in thinking/composing mode, so the retry label
and detail never rendered during the backoff. Drive the pane and the
streaming phase back to waiting when a retry begins.
* fix(kimi-code): drop the stale retry countdown once the attempt starts
The v2 engine re-emits turn.step.started when the retried attempt
begins running after the backoff sleep. Track a backoff/attempt phase
so the label keeps showing the retry attempt and error but drops the
already-elapsed 'in Xs' countdown, instead of either clearing the
state or showing stale timing through a slow attempt.
* fix(kimi-code): advance the retry phase on a timer instead of step starts
The legacy engine retries inside the same step and never re-emits
turn.step.started, so the backoff-to-attempt transition keyed on that
event never fired there and the stale countdown stayed up through the
attempt. Schedule the flip from delayMs instead, which matches when
both engines actually start the next attempt, and drop the step-start
hook.
* fix(kimi-code): cancel the retry phase timer on TUI shutdown
A pending backoff timer survived KimiTUI.stop(), keeping the event
loop alive and firing setAppState against a disposed UI when stop()
runs without an immediate process exit. Expose the timer cleanup and
invoke it from the shutdown path.
* fix(kimi-code): align the retry detail line with the spinner label
* fix(kimi-code): capitalize the retry spinner label
* feat(kimi-code): paginate the session picker list
The /sessions picker and kimi -r used to materialize the full session
list before showing anything, which gets slow with hundreds of sessions.
- node-sdk: add listSessionsPage (limit/before -> items + nextCursor);
the v2 engine pages through the session index (draining past entries
whose workDir is unrecoverable), the v1 engine answers one full page
- TUI: open the picker on the first page, fetch the next page when the
cursor reaches the fetched end, and drain remaining pages in the
background once a search query is typed so search still covers all
sessions
- kimi -r now fetches a one-item page for the latest session
* chore: simplify session picker changeset
* fix(kimi-code): join in-flight page fetch in session search drain
A query typed while a scroll-triggered page fetch was still running
stopped the background drain at the loadingMore early return, leaving
the search covering only the pages fetched so far. fetchMoreSessions
now optionally joins the in-flight fetch and continues with the next
page; scroll triggers still drop when busy.
The footer git status cache spawns git (and gh for PR lookup) on the
startup path, before the workspace trust prompt. On Windows, a bare
command name lets cmd.exe resolve a git.exe planted in the workspace
before the user confirms trust — a gap left by #2695.
Resolve git once at cache creation and gh per lookup with
resolveCommandPath(), which returns an absolute PATH hit and refuses
matches inside the workspace; when resolution fails the cache reports
no repository instead of spawning anything.
The v1 WS connection had no keepalive: by design it stayed open until the
client disconnected, which only holds for direct connections. Behind a
reverse proxy or gateway with an idle timeout (30s defaults are common),
any quiet stretch — e.g. waiting on a slow model response — got the
connection killed, surfacing as a recurring 'Realtime connection error'
in the web UI.
Send an application-level ping every 10s and advertise heartbeat_ms in
server_hello (the schema and all shipped clients already answer pong).
Application-level rather than protocol-level ping because browser JS
cannot observe the latter, and the client's stale-socket detector keys
on incoming message frames. Any inbound frame refreshes liveness; after
two silent cycles the connection is presumed half-open and closed with
1001 so dead peers get reaped instead of leaking.
* feat(kimi-code): show live background agent activity in the /tasks panel
Background agents (run_in_background or Ctrl+B) showed no run details:
the /tasks panel only had static metadata, and its output view stays
"[no output captured]" until completion because agent tasks capture
output only once at the end.
Tee child-agent events into a bounded in-memory per-agent activity
store segmented by the engine's own turn.step.started events (recent
10 steps, bounded text/output tails). The /tasks preview pane now
shows a live activity preview for agent tasks, and Enter/O opens a
full-screen detail view rendering step-grouped Markdown text and
per-tool results through the main transcript's renderers, with Ctrl+O
to expand. Agent tasks without an in-memory record (e.g. lost after
resume) fall back to the captured-output view.
* feat(kimi-code): retain 20 recent steps in the background agent activity view
* fix(kimi-code): cap the streaming-args buffer in the subagent activity store
* chore(kimi-code): simplify the background agent activity changeset
* fix(kimi-code): drop activity records of foreground-only subagents at terminal state
* fix(kimi-code): cap retained tool argument strings in the subagent activity store
* test(acp-server): retry temp-dir cleanup to deflake ENOTEMPTY on CI
* fix(kimi-code): tighten subagent activity store lifecycle edges
- drop delta-only arg buffers when their step is evicted
- keep records of spawn-time background agents even when the task sync lags
- mark records terminal on background.task.terminated for stopped agents
that never emit subagent.failed
* fix(kimi-code): release leftover arg buffers when an activity record turns terminal
* fix(kimi-code): prune foreground-only activity records when the main turn ends
* fix: surface a readable error when Git Bash is missing on Windows
* fix(agent-core-v2): translate probe rejection into HostProcessError for ready awaiters
- HostEnvironmentService.ready now rejects with the translated
HostProcessError(shell.git_bash_not_found) instead of the raw
ProbeShellNotFoundError, matching what sync field reads throw and what
SDKRpcClientV2.ensureConfigFile() surfaces, while an internal no-op
handler keeps the rejection from becoming an unhandledRejection.
- Replace the Windows-gated probe-failure tests with vi.mock-stubbed
deterministic suites that run identically on any platform.
- Move the ProbeShellNotFoundError explanation into the environmentProbe
file header per the package comment convention.
* fix(agent-core-v2): narrow probe error to Error to satisfy only-throw-error lint
* fix(agent-core-v2): preserve probe error as cause when translating to HostProcessError
* fix(agent-core-v2): keep checked paths out of the public probe error message
* fix(node-sdk): gate the host-environment wait in ensureConfigFile to Windows
The missing-Git-Bash failure is Windows-only, and IHostEnvironment.ready
also covers the login-shell PATH enrichment, which spawns the user's login
shell with a 5s timeout. Awaiting it on POSIX coupled config-only commands
(kimi provider list/remove, export, ...) to the user's shell profile for no
benefit.
---------
Co-authored-by: liruifengv <liruifeng1024@gmail.com>
- name Emitters and surface their subscriptions as on:<name> ledger
labels through a named EventSubscription class and IDisposableDebugLabel
- add IDebugEventsService.subscriptions(), merging unit-book entries
with per-bus listener counts, contributed at App scope by the new
debugEvents feature
- kap-server debug dispatcher falls back to the global decorator
registry so runtime-contributed services stay callable
- kimi-inspect: add an Events panel to the DI view
- return the enqueue-launched turn instead of rejecting with
prompt.not_found when no prompt is pending at steer time
- report steer as queued when a manual compaction holds the context
- sync title/lastPrompt metadata on main-agent steer, matching v1
- update the v1-v2 parity test to assert converged behavior
On Windows, cmd.exe / CreateProcess resolve a bare command name from the
current directory before PATH. Several startup-path child processes ran
before the workspace trust prompt, so a binary planted in an untrusted
workspace (stty.exe, npm.cmd, fd.exe) could execute before the user
confirmed trust.
- skip the POSIX-only stty save/restore entirely on win32
- defer fd detection from the KimiTUI field initializer to
startBackgroundFdAutocomplete(), which runs after the trust gate
- add resolveCommandPath(): resolve commands through PATH (PATHEXT-aware
on win32) to an absolute path and refuse hits inside the cwd
- route update-preflight package-manager spawns and the npm global-prefix
probe through it
- run the workspace trust prompt before the migration branch as well,
closing the blind spot where a pending ~/.kimi migration skipped it
- document the no-bare-command-before-trust-gate rule in
apps/kimi-code/AGENTS.md
- add onWillCreateSession to ISessionLifecycleService: a synchronous
participation event fired before a session's services activate, exposing
a session-domain facade (readSeed / contributeSeed / onSessionDispose)
- workspaceMcp subscribes and activates ephemeral-server overlays itself:
the configs travel as the new ISessionEphemeralMcpServers session seed,
the stdio cwd is read from ISessionContext, the merged ISessionMcpHandle
is contributed over the seed adapter's workspace projection, and the
overlay shutdown is attached to the session's teardown
- sessionLifecycle drops its IWorkspaceMcpService dependency, the overlay
tracking map, handle-dispose wrapping, and the dispose backstop
- rename ScopeOptions.extra to seeds and ScopeOptions.assemble to
configureContainer
- move session/btw to features/btw, mirroring the plan feature layout
- contribute ISessionBtwService at Session scope through BtwFeature
(contributeService) instead of a static registerScopedService call
- keep the package root exports unchanged; move the test to
test/features/btw
* feat(minidb): instrument open lifecycle with phase timings and status
Add MiniDb.lifecycleStatus() exposing the no-generation/generation-load/
wal-catch-up/full-rebuild/ready/degraded state machine plus per-phase
timings (generation candidate load, store/non-text/text image load,
postings integrity check, WAL scan/apply, full recovery, text rebuild
hosting), so snapshot load, WAL catch-up and full rebuild can be told
apart in diagnostics.
Also add a repeatable open-lifecycle bench (small data, large WAL delta,
large full-text generation, corrupt generation) and fixtures proving a
healthy generation open performs no full-corpus tokenization while a
corrupt or missing generation falls back. Log search-index and
query-store open diagnostics in kap-server and agent-core-v2 so a
listSessions call can be attributed to the database it touches.
No persistence format or product behavior change.
* feat(agent-core-v2): isolate the session index from the global search index
Harden the separation between the session read model and the full-text
search index so session operations never depend on search availability:
- Reject text index definitions in MiniDbQueryStore at definition level,
keeping the session query-store a structural-only read model with no
postings/tokenizer artifacts, and assert its generation carries no
full-text files.
- Share one authoritative scan between the first list and the initial
projection (single-flight) instead of scanning twice; reads may only
join an in-flight scan, and every fallback read folds the mirror's
pending queue so read-your-writes holds while preparing.
- Keep withReadModel() fallback semantics pinned by tests:
uninitialized/preparing reads hit authoritative metadata immediately,
ready reads use the read model, degraded keeps falling back with a
diagnosable status reason.
- Guard session metadata writes so a mirror failure degrades only the
read model and never fails the session lifecycle.
- Prove via tests that listSessions/--resume/--continue never open the
global search DB (including when search-index is unopenable), and that
only real full-text search requests report building/stale/degraded.
* perf(minidb): slice open-time work so it never blocks the main thread
Make the whole generation-open path cooperative:
- Replace the synchronous postings/store CRC verification with chunked
async variants (readGenerationFileCheckedAsync, verifyFileIntegrityAsync)
that keep the exact bytes/crc-mismatch error semantics.
- Give the WAL-delta apply a primitive-op + wall-clock budget
(walApplySlicer), so a batch frame unrolling into thousands of ops can
no longer run as one uninterruptible slice; torn-tail, corrupt-batch
and read-only behaviors are unchanged.
- Slice the big attach loops: Store.bulkLoadRefsAsync +
SkipList.bulkLoadAsync for the store image, async parsers and
loadImageAsync for secondary/compound images, and
TextIndex.attachImageAsync for the docs/dictionary map construction.
- Queue text builds on worker-slot pressure (WorkerSlots.acquireBounded,
bounded by MiniDb.textBuildSlotWaitMs, abort-aware) instead of falling
back to an unbounded inline build; a persisted drought hosts the
bounded inline core as the explicit last resort with stats accounting.
Bench (bench/open-lifecycle, seed 42): event-loop delay max across the
four open scenarios drops from 45/734/331/492 ms to ~12-28 ms with wall
time flat or better.
* feat(kap-server): run the global search index in a dedicated worker
Move the whole search-index MiniDb lifecycle (open, generation load,
WAL replay, sync, rebuild, compaction) off the main thread into a
long-lived worker_threads host, so it never shares the event loop with
TUI input:
- Add a versioned request/response protocol and worker entry hosting a
host-agnostic SearchIndexCore; the same core also backs an inline
backend kept as the explicit rollback
(KIMI_CODE_EXPERIMENTAL_SEARCH_WORKER=false, flag default ON).
- The worker exclusively owns the search-index handle. The lock token
is reported at acquire time (new MiniDb OpenOptions.onLockAcquired
hook) and reaped on dirty exit; an orphan-lock detector (same-pid
lock row whose token no live holder owns) recovers the window where
the token report is lost, so a mid-open crash can never freeze the
index into a silent permanent read-only.
- Crash handling: in-flight requests are rejected with typed errors,
respawn uses capped exponential backoff, per-request watchdogs
terminate wedged workers, and beginClose propagates into the worker
so dispose stays bounded during a long sync. Page tokens pin a
boot-salted generation, so tokens issued before a transparent worker
restart fail closed with invalid_page_token.
- The main process keeps the sync coordinator (debounce/coalescing/
single-flight), live transcript routing, query normalization and
page-token codec; searches keep reading the published generation and
report building/stale/degraded instead of waiting for sync/rebuild.
- Wire the worker into the CLI packaging: self-contained worker bundles
for npm dist and the SEA asset manifest/installer/smoke check, plus a
dev runtime (type-stripping + .ts resolve hook) scoped to worker
execArgv.
* feat(kap-server): model search and session-index lifecycles explicitly
Consolidate the two-index separation into explicit, diagnosable
lifecycles:
- Surface the global search state machine (stopped / opening / building
/ ready / degraded / closing) end to end: SearchIndexCore.lifecycleState,
SearchWorkerHost lifecycle snapshots cached from RPC responses (and
invalidated across worker generations), a never-throwing status()
carrying the lifecycle, and a synchronous lifecycleReport() that
neither kicks the open nor spawns the worker. Corrupt search-index
rebuilds are announced with a dedicated warn log so building, stale,
degraded, corrupt and worker-unavailable stay distinguishable.
- Turn MiniDb read-only replica catch-up fully cooperative:
catchUpWalAsync scans frames with the windowed async scanner and
yields per primitive op on the shared walApplySlicer budget, while a
per-instance catchUpChain serializes concurrent catch-ups so each
caller keeps its atomic watermark advance. The stale synchronous
implementations are removed.
- Pin the dependency direction and availability timing with tests:
session list/create/resume survive a corrupt or unopenable search
index (also end-to-end with a dead query-store), search generation
reuse and stale-serving keep working across restarts, concurrent cold
callers open the index / spawn the worker exactly once, resume-then-
fetchSessions performs no duplicate authoritative scan, and a clean
dispose releases the lock and settles at stopped.
- Document the experimental flag surface (persistence_minidb_readmodel,
search_worker) in the root guide.
* feat(agent-core-v2): default the session read model on and roll out the separation
Rollout and validation for the index separation plan:
- Flip persistence_minidb_readmodel to default ON (rollback via
KIMI_CODE_EXPERIMENTAL_PERSISTENCE_MINIDB_READMODEL=false or the
experimental config section); session list/--resume/--continue now
always go through the isolated session read model with the
authoritative fallback. Test harnesses pin the flag off where shared
fixtures require hermetic homes, while the dedicated suites keep
explicit on/off coverage.
- Add a probe proving the main thread stays responsive while the
search worker rebuilds and swaps a generation (reindex), completing
the TUI responsiveness matrix.
- Record the rollout state in the agent-core-v2 guide (session index
section) and the root flag line.
- Add changesets for the CLI (worker isolation, session index
independence) and minidb (cooperative open lifecycle).
Validation: full suites green across minidb (551), agent-core-v2
(4760), kap-server (1005), node-sdk (343), klient (91) and the CLI app
(2567); open-lifecycle bench event-loop delay max is down from
45/734/331/492 ms to ~16-22 ms across the four scenarios with wall
time flat or better.
* fix(agent-core-v2): evict deleted sessions from the mirror queue and drain the index on close
Two issues surfaced by the read-model default in the acp-server suite:
- ISessionIndex.remove only deleted from the query store, but a summary
still queued in the mirror was folded back into reads (and re-written
by the next flush), resurrecting a deleted session in listings. The
mirror now exposes evict(id): drop the queued summary and wait out an
in-flight flush before the store delete.
- RunningAcpServer.close and SDKRpcClientV2.close disposed the engine
without awaiting the asynchronous mirror flush / query-store close,
so a host removing homeDir right after close() raced in-flight shard
closes (ENOTEMPTY). Both now follow the kap-server shutdown order:
drain the mirror while the store is open, dispose, then await the
drains.
* fix(minidb): pause active expiry during the sliced bulk load
The store's active-expire timer is armed at construction, so during a
sliced bulkLoadRefsAsync a tick can fire mid-load: it reaps a TTL key
from the map while the order skiplist is still the old empty one, and
the final bulkLoadAsync then rebuilds order from the stale orderEntries
snapshot — resurrecting the expired key in the ordered index (and
duplicating it if the key is later set again). The sync bulkLoadRefs had
no yield windows, so guard the async path with a bulkLoading flag that
defers expiry ticks until the load settles (finally-safe).
* chore: consolidate changesets into the TUI startup freeze fix
- tokensBefore/tokensAfter now include the system prompt and non-deferred
tool schemas, matching the measured-anchor basis the context gauge uses
between exchanges
- the post-compaction ledger rebase carries the same full-request size, so
the reported context size no longer dips to a messages-only estimate and
jumps back on the next exchange
- the PreCompact hook tokenCount uses the same basis
* docs(agents): rework changelog curation rules for the user-facing changelog
* docs(agents): refine catch-all wording and add reviewer notes to the changelog preview
* docs(agents): surface folded entries at the sync review checkpoint
* docs: add Official Plugins section with WebBridge and Computer Use
Group the three official capabilities (Kimi Datasource, Kimi WebBridge,
Kimi Computer Use) under a new Official Plugins section on the plugins
page, with a single shared install/upgrade flow. Add an authorization
walkthrough screenshot for Computer Use and regroup the Datasource
coverage table by category with named data sources.
* docs: add browser extension install steps for Kimi WebBridge
Installing via /plugins is not enough on its own: AI can only drive the
browser after the Kimi WebBridge extension is present. Document both
install paths (Chrome Web Store / Edge Add-ons, and manual load-unpacked
via chrome://extensions with Developer mode) plus a quick way to verify.
* docs: split WebBridge manual install into illustrated steps
Break the manual extension install into numbered steps with per-step
screenshots: enable Developer mode on chrome://extensions, then load the
unpacked kimi-webbridge-extension folder.
* docs: tighten WebBridge install screenshots to the relevant area
* docs: add WebBridge ready-state verification screenshot
* docs: note WebBridge's two-part install in the shared install steps
* docs: even out WebBridge install screenshot edges
* docs: replace WebBridge install screenshots with clean crops
Re-shoot source images: split the two-step manual install guide into
per-step screenshots with clean edges, and replace the ready-state popup
screenshot with the toolbar-icon success indicator.
* docs: use newly provided WebBridge step screenshots
* docs: sharpen Computer Use auth screenshot and center it
Replace the downscaled auth-window image with a crisp native capture,
constrain its display width to 380px, and center it on the page. Also
move the WebBridge two-part install note into an info callout directly
under the shared install steps.
* docs: drop the coverage start year from the Datasource table
* docs: spell out the two WebBridge extension install options
* docs: show the Kimi Code toggle enabled in the Computer Use auth screenshot
* docs: show version badges for WebBridge and Computer Use, rework Computer Use scenarios
Add version badges next to all three official plugin names. Rewrite the
Computer Use capability list around verified task shapes and add a
warning callout for operations that should not be delegated. Keep the
final WebBridge install step inside the numbered list.
* docs: add Windows (WinCU) notes to Computer Use
Computer Use now ships a Windows runtime with a different install path
and behavior: it may briefly take over the real mouse and keyboard
instead of running fully in the background. Document the install
command, system requirements, permission model, and privilege matching,
and stop claiming the feature is macOS-only.
* docs: break up the plugin manager wall of text
Split the Installation and Management paragraph into bullets, drop the
parts duplicated by the Official Plugins section (including the outdated
macOS-only note), and link to that section instead.
* docs: list the plugin manager tabs and drop the tab-behavior block
* docs: give the WebBridge extension install section an English anchor
* docs: restore the /reload or /new activation step for official plugins
* docs: align the plugins page wording with the published docs site
* chore: retrigger CI
---------
Co-authored-by: qer <wbxl2000@outlook.com>
* fix(agent-core-v2): gate plugin changes behind session baselines and reminders
- capture a per-session MCP server baseline (ISessionMcpHandle.isBaselineServer)
so servers added mid-session (plugin install, mcp.json edit) never register
tools in live sessions; they take effect on /new, /reload, or resume, while
removed servers stay tombstoned and fail calls with a removal notice
- stop rebuilding the system prompt on plugin-source catalog changes: the
frozen skill listing and plugin sections cannot move anyway, and the rebuild
only churned the ${now} timestamp, invalidating the provider prompt cache
- freeze the Agent tool description's catalog profile list once the session
catalog has loaded, keeping the tools payload byte-stable across mutations
- append a plugin_change system reminder to live sessions on plugin mutations
(new IPluginService.onDidMutate; explicit reloadPlugins does not raise it)
- revert the TUI hint to "Run /new or /reload to apply plugin changes." and
update the plugin/MCP docs and changesets to the corrected contract
* fix(agent-core-v2): import LifecycleScope from app/scopes in sessionOutcomeMirror
#2666 imported LifecycleScope from #/_base/di/scope, which does not export
it (it lives in #/app/scopes), breaking the package build and typecheck on
main.
* fix(agent-core-v2): close the mutation-driven session-start refresh and overlay baseline leaks
Codex review on the PR found two contract leaks:
- a plugin mutation re-pulls the plugin skill source, and the existing
catalog listener answered with a fresh plugin_session_start reminder —
injecting the newly installed plugin's instructions into the live session
alongside (and contradicting) the plugin_change notice. The session-start
refresh now skips mutation-driven catalog changes (one per mutation,
counted; explicit reloads keep the old refresh behavior).
- a session created with ephemeral mcpServers kept its MCP baseline open
until the overlay connect finished; a workspace server added in that
window (plugin install, config edit) leaked into the live session through
the merged view. The overlay handle's baseline now freezes on the
workspace manager's initial load, with the ephemeral names baseline by
construction.
* fix(agent-core-v2): drop duplicate LifecycleScope import in sessionOutcomeMirror test
---------
Signed-off-by: Haozhe <yanghaozhe@moonshot.ai>
The L3 unit layer refactor moved LifecycleScope out of the _base DI kernel
into the app tier, leaving the session outcome mirror with a stale import
that broke typecheck and import-time evaluation on main.
* feat(agent-core-v2): persist the last turn outcome into session metadata for cold listings
A cold session (no live handle) reported no lastTurnReason, so after a
server restart the session list could not mark a session whose last turn
failed until it was opened and resumed.
A new Session-scope SessionOutcomeRecorder subscribes to the activity
aggregate's turn_ended changes and persists the outcome
(completed/failed) into the session metadata document; the summary
pipeline (mirror + cold reader) carries it as SessionSummary
.lastTurnReason, and toWireSession falls back to it when no live fact
exists. 'cancelled' is deliberately not persisted: it is also what an
in-flight turn ends with during scope disposal, and writing there races
the host's home-dir teardown.
Verified end to end with an isolated home and a dead provider: a turn
fails, the server restarts, and GET /sessions reports
last_turn_reason=failed without opening the session.
* fix(klient): carry lastTurnReason/lastTurnOutcome in the validated contracts
Review follow-up: zod strips unknown keys on parse, so the new outcome
fields never reached klient callers; add them to the session summary and
metadata/patch/key schemas (contract parity test covers the engine
mirror).
* fix(agent-core-v2): persist user-cancelled outcomes, never teardown aborts
Review follow-up: skipping every 'cancelled' left a stale earlier outcome
in the metadata (e.g. a prior failed reported for a session whose latest
turn was stopped by the user). The recorder now subscribes to the main
agent's turn.ended facts directly and keys on interruptReason:
user_cancelled is persisted like any other terminal state, while
programmatic aborts — including the cancel every in-flight turn suffers
during scope disposal — are never written, so no metadata write races the
host's home-dir teardown.
* fix(kap-server): only fall back to the persisted outcome for cold sessions
Review follow-up: a warm session that just started a new turn clears its
live lastTurn, and the unconditional ?? fallback would then report the
previous turn's persisted outcome for a turn that is still running.
SessionFacts now reports whether a live handle exists, and the wire
projection only reads the persisted value when the session is cold.
* docs(agent-core-v2): keep the outcome-recorder header at role level
* fix(agent-core-v2): settle turn outcomes on turn start and drain metadata writes on close
Review follow-ups:
- a new main turn now clears the persisted outcome (turn.started), so a
process that dies mid-retry no longer reports the previous turn's
terminal state for a turn that never ended
- the dedupe marker only advances after a successful write, so a failed
persist no longer suppresses the next identical outcome
- session metadata writes are tracked in a module-level pending set with
drainSessionMetadataWrites(), awaited by kap-server close alongside the
mirror/query-store drains — an event-driven write (e.g. the outcome
recorder) can no longer land in a session dir while the host removes it
* fix(agent-core-v2): track the metadata dispose flag locally
Disposable exposes no public isDisposed accessor; keep a class-local flag
set in the dispose override.
* fix(kap-server): drain session metadata writes before the mirror and disposal
A write still in flight when close() begins must settle before the mirror
flushes its summary into the read model and before scope disposal marks
the service disposed — not after.
* fix(agent-core-v2): reattach the recorder when the main agent is recreated
Review follow-up: a failed bootstrap still fires onDidCreate before the
handle is dropped; the subscription then pointed at a dead bus and the
guard blocked any later reattach. Track onDidDispose and reset so the
next main creation attaches cleanly.
* test(agent-core-v2): resolve the recorder through the scoped DI harness
Review follow-up: construct SessionOutcomeRecorder via registerScopedService
+ a Session-scope test host (stubbed lifecycle/metadata), so the test covers
the production registration path; add the durable-value adoption case.
* fix(agent-core-v2): unbreak CI — iterable Promise.all and the debug channel surface
- Promise.all takes the pending-writes set directly (oxlint error)
- the disposed flag moves into a _register'd marker instead of a public
dispose() override, which the debug channels listing (and its test)
correctly rejects as framework plumbing
* fix(kap-server): surface persisted failures on the v2 session status
The v2 list folds the outcome into activity.status, which previously
read only live facts — a cold session always looked idle. Cold sessions
now map a persisted failed outcome to status 'failed' (completed and
cancelled stay idle, matching the live fold); warm sessions are
unchanged, and the statuses filter inherits the mapping.
* refactor(agent-core-v2): name the persisted field lastTurnReason
Aligns with the established name for the same concept end to end
(activity view's lastTurnReason, the v1 wire's last_turn_reason, and the
SessionSummary mirror), instead of introducing a third variant.
* fix(agent-core-v2): drain pending metadata writes before session teardown
Review follow-up: closing/archiving a session right after a turn ended
could dispose the scope while the outcome write was still queued, and
delete() removes the session dir immediately after close. Await the
pending metadata writes before the handle goes away.
* fix(node-sdk): carry lastTurnReason through the SDK session summary
Review follow-up: the in-process SDK path maps the engine summary through
v2SummaryToSessionSummary, which dropped the new outcome field. Add it to
the public SessionSummary type and the mapper; the parity gate projects
it away (the v1 engine never records an outcome).
* fix(node-sdk): populate lastTurnReason on live SDK summaries
Review follow-up: resumeSession/reloadSession build their summary from the
live session's metadata document, which now carries the outcome — surface
it there too so the SDK reports it consistently for live and listed
sessions.
* fix(agent-core-v2): carry the last turn outcome across session forks
Review follow-up: fork skips state.json when copying the session dir, so
the fork's fresh metadata never had the outcome and a restart dropped a
marker the warm fork was still reporting. The fork's metadata patch now
inherits the source's lastTurnReason.
* fix(agent-core-v2): settle pending outcome writes before reading a fork source
Review follow-up: a fork requested right after the source's turn ended
could read the metadata before the recorder's queued write landed,
inheriting a stale or absent outcome. Drain pending metadata writes
first.
* fix(agent-core-v2): backfill restored outcomes into the session metadata
Review follow-up: for sessions whose last turn ended before this field
existed, the cold-resume seed restores the outcome into the activity view
without a turn.ended fact, so the recorder never persisted it and cold
listings stayed blank. The recorder now also watches the main agent's
activity updates and backfills the restored outcome when nothing is
persisted yet.
* fix(agent-core-v2): never backfill restored cancellations
Review follow-up: a restored 'cancelled' cannot be told apart from a
programmatic abort (the activity event carries no interruptReason), and
those are never persisted. Backfill now covers only completed/failed;
user stops are still persisted from the live turn.ended fact.
* refactor(agent-core-v2): rename the outcome recorder to outcome mirror
Mirror is the codebase's established term for a write side that reflects
live state into a store (SessionIndexMirror); Recorder has no precedent.
* fix(agent-core-v2): backfill without bumping recency; header-only comments
Review follow-ups:
- a mere resume must not float an old session to the top of the list:
metadata updates accept touchUpdatedAt:false and the outcome mirror's
backfill uses it (live outcome writes keep bumping — turn end is a
recency moment)
- the mirror service's inline notes move into the file header per the
package comment convention
- drop the redundant |undefined from the SDK's optional outcome field
* fix(node-sdk): read the live outcome for resumed session summaries
Review follow-up: on a fresh resume the restored outcome can still be
queued as a metadata backfill, so the document may lag a tick; the live
activity aggregate already holds it. Resume/reload summaries now prefer
the live value and fall back to the metadata field.
* fix(agent-core-v2): confine the outcome backfill to pure resumes
Review follow-up: the view publishes its turn.ended fold before this
mirror's own turn.ended handler runs, so a live ending reached the
backfill branch first and got persisted without the recency bump. The
backfill now only applies when no turn ever started in this process —
live endings always take the bumped write.
* fix(agent-core-v2): drain the session-index mirror before session teardown
Review follow-up: settling the metadata write alone left the fresh
summary in the mirror's pending queue, so a list right after close could
read a stale outcome from the read model. close/archive now also drain
ISessionIndexMirror. Test harnesses register a mirror stub for the new
dependency.
* docs(agent-core-v2): fold the metadata drain contract into the file header
* chore: include the SDK package in the changeset; fold the drain note into the header
* fix(agent-core-v2): backfill restored cancellations too, quietly
Review follow-ups: dropping every restored cancel loses legitimate user
stops whose live write never landed (or was rejected) before a restart —
cold surfaces never mark cancelled anyway, so healing them is harmless
and strictly more accurate. The metadata disposal note moves into the
file header per the comment convention.
* fix(node-sdk): prefer the live outcome over the index in SDK listings
Review follow-up: a live session that just started a new turn after a
failure can briefly keep the stale outcome in the index while the
mirror's clear is queued. listSessions now reads the live activity
aggregate for warm sessions, matching the kap-server cold-only fallback.
* fix(node-sdk): never read the metadata outcome for a live session
Review follow-up: with a retry in flight the live aggregate has no
outcome while the document may still hold the previous failure — the
fallback showed the stale one. Live summaries now take the live
aggregate's answer alone; the restored outcome is already seeded there
on resume.
* chore: sync web dist from code-app
* chore: add changesets for the synced web UI changes
* chore: drop changesets already covered by the previous web bundle sync
* chore: correct the drop-folder changeset for web
* chore: drop the drop-folder changeset (desktop-only feature, no web announcement)
* feat(mcp): tombstone removed MCP servers and apply plugin changes immediately (20 files)
- add 'removed' MCP server status: workspace config removals call markRemoved
instead of remove, keeping tool registrations alive while short-circuiting
calls with a removal notice
- fire onDidReload after every plugin mutation (install/enable/disable/remove)
so workspace consumers refresh contributions immediately
- TUI renders the removed status in the MCP panel/startup summary and shows an
apply-immediately hint on the v2 engine
* feat(agent-core-v2): freeze plugin prompt inputs for live agents (2 files)
- snapshot the model skill listing and plugin system-prompt sections on the
first successful prompt build and reuse the frozen values for the agent's
lifetime, so plugin install / enable / disable / remove / reload never
rewrites a live agent's prompt (same keep-live-sessions-stable philosophy
as the MCP tombstone)
- freeze only on success: a not-yet-ready skill catalog or a failed
enabledSystemPrompts() read must not pin empty values for the agent's
lifetime
- refreshSystemPrompt still rebuilds on catalog change events but reuses
the frozen values, so the prompt only moves when non-plugin inputs change
(AGENTS.md, [tools] section, session tool policy, compaction); new agents
snapshot the then-current state
* chore(changeset): add changesets for MCP tombstone and frozen plugin prompt inputs
* docs: describe immediate plugin changes and the removed MCP status on the v2 engine
* fix(klient): mirror the removed MCP server status in the wire contract
* docs: drop the legacy-engine behavior notes from the plugin and MCP pages
* fix(agent-core-v2): freeze plugin sections only on a loaded snapshot
- enabledSystemPrompts() resolves to its consumption fallback (never
rejects) while the initial plugin load has failed; freezing that empty
read locked plugin sections out of the live agent even after a later
successful reload
- expose hasLoadedSnapshot() on IPluginService so resolvePluginSections
can tell a real empty snapshot from the fallback before freezing
* feat(kap-server): accept attachments on skill activation
The :activate endpoint only took {args?}, so REST clients (web/desktop
composers) could not attach uploads to a /skill invocation — attachments
were silently dropped at the edge.
- activateSkillRequestSchema gains an optional attachments field carrying
the image/video/file subset of the prompt content wire shape.
- The skills route resolves them through the same edge pipeline as prompt
submissions (validate file refs → materialize/compress → convert),
extracted from routes/prompts.ts into lib/promptMedia.ts.
- AgentSkillService.activate appends the resolved parts after the rendered
skill prompt in the activation's user message; SkillActivationInput
gains an optional content field. The native RPC/TUI path is unchanged.
- Attachment failures map to 40407 file.not_found / 40001
validation.failed, mirroring the prompts route.
* fix(kap-server): drop the unused parseKimiFileUrl import in promptMedia
* refactor: address review — header-only comments in the skill domain, provider id on protocol URL sources
- agent-core-v2 keeps comments solely in the top-of-file block (scoped
guide): SkillActivationInput.content documented in the skill.ts header,
the activate() note folded into the skillService.ts header.
- packages/protocol's image/video URL source gains the optional
provider-issued id, matching the kap-server wire schema so parsing the
public contract no longer strips it.
* fix(kap-server): validate the skill before materializing activation attachments
An unknown or non-user-activatable skill name with attachments ran the
media pipeline first, streaming bytes into the session/cache dirs and
compressing images for a request that activate() would reject with
40415/40912. The route now checks the session catalog up front (the
service still re-validates) so invalid activations leave no disk or CPU
side effects.
- align the REST status rollup with the WS push: a bound alias that no
longer resolves omits max_context_tokens instead of reporting 0 (0 is the
engine's UNKNOWN_CAPABILITY marker, not a real limit)
- fall back to the default model's limit only when no model is bound,
resolved through IModelService like the WS side
- mark max_context_tokens optional in the shared session status schema
* feat(agent-core-v2): add the L3 unit layer and the Feature seam
- introduce the L3 Service/Fiber unit layer: the Service base class with this.provide/effect/on/get/ref capabilities, the fiber runtime with thenable FiberHandles, collection contribution points, and the per-scope-kind ScopeUnits materialization fold
- provide each scope's static registration batch as one atomic provideAll cascade transaction (waiting-area activation, sticky Failed on construction error)
- add the DI unit inspection surface: App-scope debug ledger / dependency graph / cascade history services and the kimi-inspect DI view
- add the Feature unit seam (IFeatureManager + feature assembly), port plan mode onto it, and add the contributed-command seam (agent-command domain + node-sdk RPC types)
- remove the legacy dep-graph tooling
- apply the header-only comment convention across src and test: strip non-header narration, keep the file header, tooling pragmas, and NOTE comments
* feat(kap-server): gate the event.di.* debug feed to kimi-inspect connections
- add an opt-in target set in SessionEventBroadcaster; the global fan-out
now skips event.di.* frames for connections that never opted in, so
kimi-web and other clients no longer receive the high-churn DI feed
- WsConnectionV1 opts a connection in when client_hello carries
client_id 'kimi-inspect'; removeGlobalTarget drops the opt-in on close
- temporary gate until a client-declared event-type whitelist lands
* chore(agent-core-v2): fix oxlint errors in the DI unit layer
- build the live-ref container chain without aliasing this (no-this-alias)
- snapshot the materialized map with Array.from and document why the copy
is required (no-useless-spread)
* test(klient): use string scope kinds in the lifecycle handle fakes
The engine's LifecycleScope is a string enum now; the facade test doubles
still returned the old numeric kinds and failed the handleWireSchema output
validation.
* build(nix): update the pnpmDeps fetch hash
* fix(kimi-code): select compatible PowerShell for Computer Use
* fix(kimi-code): handle locked Computer Use plugin files
* fix(kimi-code): align Windows Computer Use name
* fix(agent-core-v2): reuse PowerShell fallback for detection
* fix(agent-core-v2): refresh ready Computer Use plugin
* feat: surface the bound model on subagent UIs
The subagent.spawned event now carries the display-normalized model alias
(the derived __secondary__ entry resolves to its base alias), so clients can
show which model a subagent is bound to. The TUI subagent card, swarm panel
header, and background-agent entry show it at spawn; the WS snapshot roster
and REST /tasks (background/detached subagents) carry it too, keeping the
model visible across client reconnects.
* feat: carry the subagent thinking effort alongside the model
The spawned event, snapshot roster, and REST /tasks now also carry the
child's effective thinking effort (read from the child profile at spawn, the
same vocabulary as agent.status.updated). UIs show it only when it diverges
from the main session's current effort — an inherited level adds no
information, and 'off' is never shown.
* feat(tui): show the bound model and effort in the /tasks browser
The task browser's Detail pane renders Model and Effort rows for agent
tasks (raw alias and level — it is the inspector surface, so no diff
filtering), and its minimum height grows to fit the new rows. The values
were already persisted on SubagentTaskInfo; the TaskInfo union, its zod
schemas (protocol, kap-server, klient contract), and the v1 type
declaration now carry them so nothing strips them in transit.
* feat(tui): show concrete subagent effort levels unconditionally
Display rule simplified: any concrete effort tier (low/high/max/…) is
shown next to the model — including when it matches the main session's
level. Only the boolean states stay hidden: 'off' (no thinking) and 'on'
(generic thinking) carry no level information.
* docs: trim the changeset entry
* fix(tui): keep the model and effort on background-agent entries across resume
replayBackgroundProjection only copied agentId/parentToolCallId/
description, so a background subagent that outlived a resume lost its
model/effort on the later terminal transcript entry. The projection now
threads the persisted values (catalog-mapped model; boolean effort states
dropped), and session replay passes the loaded model catalog through.
* fix(agent-core-v2): normalize the derived secondary alias regardless of the flag
A child bound while the secondary-model experiment was on keeps
__secondary__ in its persisted binding; if the flag is later switched off
with the recipe still configured, resolveSecondaryModel() gated the
normalization and the sentinel leaked back onto resumed subagents.
subagentDisplayModel now reads the recipe straight from config (the flag
gates new bindings, not the interpretation of existing ones), which also
drops SessionSwarmService's now-unused IFlagService dependency. Also adds
the SDK package to the release: the new SubagentSpawnedEvent/AgentTaskInfo
fields are SDK-visible types.
* fix(agent-core-v2): normalize the status-frame model at the source
A derived-bound child republishes agent.status.updated right after spawn
with its raw modelAlias, which overwrote the spawned event's normalized
display model on single-subagent cards (swarm headers were first-wins and
escaped). emitStatusUpdated now maps through subagentDisplayModel, a no-op
for the never-derived main agent. Also moves the inline comments added by
this branch into top-of-file headers per the v2 comment convention.
* fix(tui): clamp the /tasks detail frame to the available body
At terminals near the minimum height the forced 10-row detail frame
overflowed the body and truncated the preview frame's border. The detail
height now caps out at whatever leaves the preview its borders plus one
content row, with a regression test at exactly MIN_HEIGHT.
* fix: normalize inherited derived aliases and keep model/effort on replayed terminal entries
- resolveSubagentBinding's caller-fallback branch also maps through
subagentDisplayModel: a caller itself bound to the derived entry (a
resumed subagent making a nested Agent call) no longer publishes
__secondary__.
- The replayed background-task terminal notification builds its metadata
with the persisted model (catalog-mapped) and concrete effort, matching
the live completion path.
- Drops the inline comments this branch added inside v2 test bodies; the
scenario context lives in the source file headers.
* feat(agent-core-v2): detect prompt-cache breaks from per-step usage and emit telemetry
Track consecutive turn-scoped LLM requests per agent; when the cache-read
token count drops by more than 5% and by more than 2000 tokens between
requests, log a debug line and emit cache_break_detected with both usages,
the drop ratio, and the interval. Operation requests (e.g. compaction) act
as a baseline barrier so expected drops are not reported.
* feat(tui): add cache-expiry hint dialog for resumed and idle sessions (v2 engine)
Resuming a long-idle session or submitting after a long idle stretch
re-sends the whole history with an expired context cache. Show a dialog
offering to compact, start a new session, continue as-is, or never ask
again (persisted as cache_expiry_hint in tui.toml). Thresholds come from
the client_configs endpoint (estimated_cache_duration) via a generic
per-name cached client; only OAuth-managed providers participate.
* fix(tui): preserve submit order and revalidate session in cache-hint flows
Cold-cache submits during the in-flight config fetch are now swallowed and
replayed through a FIFO chain, so a later prompt can never overtake the
stashed one. Both the resume and idle paths re-check the current session
after the async fetch: a switch mid-flight drops the dialog (resume) or
hands the stashed input back to the editor instead of sending it into the
wrong session (idle).
* chore(agent-core-v2): regenerate state manifest after merging main
* fix(tui): apply cache_expiry_hint on /reload and /reload-tui
* fix(agent-core-v2): skip unmeasured all-zero usage in cache break detection
* fix(tui): restore chained cache-hint submits when the dialog is not sent
When several submits are swallowed during the cold-config fetch and the
first dialog is dismissed (or its compact/new action fails), the stashed
inputs were restored while later chained submits were still released —
reordering the conversation. Chained submits now follow the fate of the
message that opened the dialog, and multiple restores append newline-joined
instead of overwriting the editor.
* fix(agent-core-v2): reset cache-break baseline on model change
Caches are per-model, so a cache-read drop after /model is expected, not a
break. The baseline now carries the model and only same-model records are
compared.
* fix(tui): only count LLM-activity replay records for the resume cache hint
The v2 resume replay also carries local-only state records (permission,
plan, config updates, approval results) that slash commands append without
an LLM request. Filter lastActiveAt to message/compaction records so a
recent local change no longer masks an expired cache.
* style(agent-core-v2): rewrite the cacheBreak impl header per package convention
State the domain role, collaborators, and scope instead of narrating
implementation steps; the behavior guards now live in the code alone.
* fix(tui): drop the resume cache hint when a turn started mid-fetch
The resume dialog is fire-and-forget over an async config fetch; if the
user already sent the first prompt by the time it resolves, mounting would
overlay an active turn and its actions would hit the live session. Re-check
streamingPhase/isCompacting after the await, next to the session check.
* style(agent-core-v2): trim the cacheBreak contract header to contract and scope
* refactor: report cache-break detection from the TUI client
Move the detector out of the engine so the telemetry event carries the
client's own identity (which client produced it is now attributable). The
TUI observes main-loop turn.step.completed usage directly, with the same
guards: first-step/unmeasured/all-zero records skipped, model change and
compaction reset the baseline. The agent-core-v2 cacheBreak module is
removed.
* chore: drop accidentally committed dist-web build output and ignore it
* chore: revert the dist-web ignore rule
* chore: restore dist-web to the tracked content from main
* feat(tui): record cache breaks caused by mid-session model/effort switches
A model or effort change mid-session busts the prompt-cache key — that is
a real cache break worth attributing, not noise. The baseline now carries
model and effort, the same-model exemption is gone, and cache_break_detected
reports prev/curr model and effort alongside both usages.
* chore(changeset): simplify the cache-expiry hint entry
* chore(changeset): trim the cache-expiry hint entry to one line
* fix(tui): cache-hint review follow-ups
- carry the pre-dialog media extraction through compact/new resends so
pasted attachments survive the image-store clear on a new session
- reset the cache-break baseline after /undo — the context cut makes the
next cache-read drop expected
- release the stashed submit when a foreground operation started during
the cold-config fetch instead of mounting the dialog over it
- count a completed compaction as activity so the next submit is not
judged against the pre-compaction timestamp
* chore(changeset): drop the v2-engine-only suffix
* fix(tui): seed the activity baseline when the resume check skips
* fix(tui): cache-hint review follow-ups
* fix(tui): record cache activity on completed steps, not turn begin
* feat(cli): persist the client-configs cache across restarts
The 10-year default print wait ceiling (315360000s) overflowed Node's
setTimeout limit (2^31-1 ms) into a 1ms fire, so the steer/drain wait
returned instantly and kimi -p exited right after the main turn, killing
pending background tasks and subagents.
- add setClampedTimeout in agent-core-v2 _base, clamping delays to
MAX_TIMER_DELAY_MS, and route every config-driven timer through it
(timeoutOutcome, task wait/manager timeout, swarm attempt timeout)
- chunk the print turn-endings wait against the real deadline instead of
returning null on the first clamped timer fire
- restore v1 semantics: a non-positive swarm subagent timeout is unbounded
- default print_wait_ceiling_s to 2147483s (~24.8 days, the timer maximum)
- detect UTF-16 LE/BE from a BOM or a zero-byte parity heuristic
(tolerant of CJK content), derived from VS Code's encoding detection
- Read tool and workspace fs.read transcode UTF-16 text to UTF-8
instead of refusing it as binary; larger than 10 MiB still refused
- refuse other non-UTF encodings (e.g. GBK) with a clearer message
* fix(agent-core-v2): seed the activity view's lastTurn from the persisted turn.ended record
A cold-resumed agent seeded its activity view only from live loop/task
state, so the last turn's outcome was lost on a server restart: sessions
came back with no lastTurnReason, and clients could not surface a
previously failed turn (e.g. a provider 429 that killed the turn before
the restart).
The loop already persists the terminal turn.ended record (reason, error,
durationMs); fold the latest one into the TurnModel as lastEnded and have
AgentActivityView.seedFromLoop adopt it when no turn is active, so the
session work aggregate (and everything built on it) reflects the last
turn's outcome again after a cold start.
* fix(agent-core-v2): seed lastTurn on wire restore and add a changeset
Review follow-up: the agent scope (and with it this view) is constructed
before wire.restore() replays the journal, so a constructor-time read of
TurnModel.lastEnded always saw the initial state on a cold resume. Move
the wire-backed seed behind the onDidRestore hook (constructor seed kept
for views built after a restore), and drop the inline comments in favor
of the file header per the package comment convention.
* docs(agent-core-v2): trim the activityView header to role and collaborators
Review follow-up: the previous revision narrated the restore-hook
mechanics in the header; the package convention keeps headers at the
module's external role plus collaborators, so drop the implementation
narrative.
* fix(agent-core-v2): keep TurnModel.lastEnded across clock advances
Review follow-up: advanceTurnClock built a fresh state object without
spreading, so a new prompt or a queued cancel silently dropped the stored
last-ended outcome even though no new turn had ended — after a restart the
activity view would again find nothing to seed. Spread the prior state and
cover the prompt/queued-cancel/replace cycle with a model-level test.
* fix(agent-core-v2): clear the stored turn outcome once a newer turn starts
Review follow-up: with the clock advances preserving lastEnded, a prompt
persisted without its turn ever starting would leave the previous turn's
outcome to be seeded after a restart, reporting a stale result for a turn
that never ended. The loop-event fold now drops lastEnded as soon as a
newer turn's events land, while prompts and queued cancels keep it.
* docs(agent-core-v2): keep the turnOps header at the domain role
Review follow-up: the lastEnded keep/clear mechanics read as
implementation narrative in the header; the convention there is role and
collaborators only.
explorer.exe parses its raw command line rather than argv, so Node's
default spawn quoting breaks the `/select,` argument whenever the path
contains spaces: the command line becomes `"/select,\"C:\...\""`, which
explorer rejects, silently opening the Documents folder instead of
selecting the file. Quote only the path portion and launch with
windowsVerbatimArguments so the command line keeps the documented
`/select,"C:\some dir\f.txt"` form.
- return the domain-grouped page payload inside { code, msg, data,
request_id } and carry business outcomes in code (40001 invalid
params with details, 40922 page_token mismatch) instead of raw HTTP
statuses plus an { error: { code, message } } body
- add ErrorCode.PAGE_TOKEN_MISMATCH (40922)
- register the route via defineRoute (shared runtime validation and
envelope-wrapped OpenAPI docs); fold include-domain validation into
the query schema and replace the preprocess/doc-twin pair with
scalar-or-array union params
- update the kimi-inspect client to unwrap the envelope and sync the
two AGENTS.md guides
- kap-server: add GET /api/v2/sessions with a domain-grouped response
(workspace / meta / activity, opt-in git), status / archived /
updated_after filters, three sort orders, and fingerprint-bound opaque
cursor pagination
- kimi-inspect: rebuild the chat sidebar as a spreadsheet-like session
table on the v2 endpoint — preset views (All / Opened / Archived /
By workspace / Git), column visibility config, header sort toggles,
cursor-paged Load more, and localStorage-persisted panel prefs
- live activity frames from the WS hub override the REST status badge;
session created / meta-updated events invalidate the v2-sessions query
* fix(kimi-code): open /feedback to all signed-in users
Gate the command on holding a kimi-for-coding OAuth token instead of
the active model's provider, so signed-in users on API-key models can
also submit feedback through the authenticated channel. When signed
out, open the sign-up page alongside GitHub Issues.
Also harden the failure paths: a failing auth status lookup or a
rejected submit promise now falls back to GitHub Issues, while
attachment-stage failures degrade to a non-fatal partial failure
instead of triggering the fallback.
* fix(kimi-code): print sign-up and issue links for signed-out /feedback
Opening two browser pages at once is jarring; just print the links in
the transcript instead.
* docs(changelog): sync 0.33.0 from apps/kimi-code/CHANGELOG.md
* docs(changelog): move the v2 engine entry to Refactors and the trust prompt to Polish
