630 commits

Author	SHA1	Message	Date
github-actions[bot]	f6ee44e426	ci: release packages (#2710) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-12 11:45:35 +08:00
Haozhe	101c4d1997	feat(agent-core-v2): remove Agent and AgentSwarm from builtin profile tool lists (#2837) ... * feat(agent-core-v2): remove Agent and AgentSwarm from builtin profile tool lists The builtin agent and coder profiles no longer expose the Agent and AgentSwarm tools, so sessions on the v2 engine do not offer subagent delegation by default. The tools themselves remain registered; profiles that list them explicitly can still opt in. * feat(agent-core): remove Agent and AgentSwarm from builtin profile tool lists Align the v1 builtin agent/coder profiles with the v2 change: the default profiles no longer offer subagent delegation, while the tools stay registered for profiles that list them explicitly. The parity projection drops v1's inactive Agent/AgentSwarm roster entries: v1 reports registered-but-inactive builtin tools where v2 only registers the tools a profile lists, so an inactive entry has no v2 counterpart. Active entries still compare in full. * fix: keep Agent and AgentSwarm in the builtin agent profile Scope the removal to the coder subagent profile on both engines: the main agent keeps Agent/AgentSwarm so default sessions can still delegate, while coder subagents no longer spawn nested subagents by default. Snapshots and token counts shift only for the embedded coder tool list; the v1 parity projection needs no change since the main agent rosters match again.	2026-08-12 11:41:02 +08:00
liruifengv	3c9e3b297c	feat(kimi-code): paginate the session picker list (#2826) ... * feat(kimi-code): paginate the session picker list The /sessions picker and kimi -r used to materialize the full session list before showing anything, which gets slow with hundreds of sessions. - node-sdk: add listSessionsPage (limit/before -> items + nextCursor); the v2 engine pages through the session index (draining past entries whose workDir is unrecoverable), the v1 engine answers one full page - TUI: open the picker on the first page, fetch the next page when the cursor reaches the fetched end, and drain remaining pages in the background once a search query is typed so search still covers all sessions - kimi -r now fetches a one-item page for the latest session * chore: simplify session picker changeset * fix(kimi-code): join in-flight page fetch in session search drain A query typed while a scroll-triggered page fetch was still running stopped the background drain at the loadingMore early return, leaving the search covering only the pages fetched so far. fetchMoreSessions now optionally joins the in-flight fetch and continues with the next page; scroll triggers still drop when busy.	2026-08-12 11:21:43 +08:00
qer	619564dcf9	fix(kap-server): add WebSocket heartbeat to survive proxy idle timeouts (#2813) ... The v1 WS connection had no keepalive: by design it stayed open until the client disconnected, which only holds for direct connections. Behind a reverse proxy or gateway with an idle timeout (30s defaults are common), any quiet stretch — e.g. waiting on a slow model response — got the connection killed, surfacing as a recurring 'Realtime connection error' in the web UI. Send an application-level ping every 10s and advertise heartbeat_ms in server_hello (the schema and all shipped clients already answer pong). Application-level rather than protocol-level ping because browser JS cannot observe the latter, and the client's stale-socket detector keys on incoming message frames. Any inbound frame refreshes liveness; after two silent cycles the connection is presumed half-open and closed with 1001 so dead peers get reaped instead of leaking.	2026-08-12 00:28:03 +08:00
liruifengv	ad12ad8a14	feat(kimi-code): show live background agent activity in the /tasks panel (#2816) ... * feat(kimi-code): show live background agent activity in the /tasks panel Background agents (run_in_background or Ctrl+B) showed no run details: the /tasks panel only had static metadata, and its output view stays "[no output captured]" until completion because agent tasks capture output only once at the end. Tee child-agent events into a bounded in-memory per-agent activity store segmented by the engine's own turn.step.started events (recent 10 steps, bounded text/output tails). The /tasks preview pane now shows a live activity preview for agent tasks, and Enter/O opens a full-screen detail view rendering step-grouped Markdown text and per-tool results through the main transcript's renderers, with Ctrl+O to expand. Agent tasks without an in-memory record (e.g. lost after resume) fall back to the captured-output view. * feat(kimi-code): retain 20 recent steps in the background agent activity view * fix(kimi-code): cap the streaming-args buffer in the subagent activity store * chore(kimi-code): simplify the background agent activity changeset * fix(kimi-code): drop activity records of foreground-only subagents at terminal state * fix(kimi-code): cap retained tool argument strings in the subagent activity store * test(acp-server): retry temp-dir cleanup to deflake ENOTEMPTY on CI * fix(kimi-code): tighten subagent activity store lifecycle edges - drop delta-only arg buffers when their step is evicted - keep records of spawn-time background agents even when the task sync lags - mark records terminal on background.task.terminated for stopped agents that never emit subagent.failed * fix(kimi-code): release leftover arg buffers when an activity record turns terminal * fix(kimi-code): prune foreground-only activity records when the main turn ends	2026-08-11 21:32:39 +08:00
HydrogenE7	158c81d705	fix: surface a readable error when Git Bash is missing on Windows (#2814) ... * fix: surface a readable error when Git Bash is missing on Windows * fix(agent-core-v2): translate probe rejection into HostProcessError for ready awaiters - HostEnvironmentService.ready now rejects with the translated HostProcessError(shell.git_bash_not_found) instead of the raw ProbeShellNotFoundError, matching what sync field reads throw and what SDKRpcClientV2.ensureConfigFile() surfaces, while an internal no-op handler keeps the rejection from becoming an unhandledRejection. - Replace the Windows-gated probe-failure tests with vi.mock-stubbed deterministic suites that run identically on any platform. - Move the ProbeShellNotFoundError explanation into the environmentProbe file header per the package comment convention. * fix(agent-core-v2): narrow probe error to Error to satisfy only-throw-error lint * fix(agent-core-v2): preserve probe error as cause when translating to HostProcessError * fix(agent-core-v2): keep checked paths out of the public probe error message * fix(node-sdk): gate the host-environment wait in ensureConfigFile to Windows The missing-Git-Bash failure is Windows-only, and IHostEnvironment.ready also covers the login-shell PATH enrichment, which spawns the user's login shell with a 5s timeout. Awaiting it on POSIX coupled config-only commands (kimi provider list/remove, export, ...) to the user's shell profile for no benefit. --------- Co-authored-by: liruifengv <liruifeng1024@gmail.com>	2026-08-11 21:13:08 +08:00
Haozhe	860354976e	feat(agent-core-v2): add event-subscription introspection (#2806) ... - name Emitters and surface their subscriptions as on:<name> ledger labels through a named EventSubscription class and IDisposableDebugLabel - add IDebugEventsService.subscriptions(), merging unit-book entries with per-bus listener counts, contributed at App scope by the new debugEvents feature - kap-server debug dispatcher falls back to the global decorator registry so runtime-contributed services stay callable - kimi-inspect: add an Events panel to the DI view	2026-08-11 14:55:08 +08:00
Haozhe	e702817124	fix(agent-core-v2): degrade idle-session steer to turn launch like v1 (#2723) ... - return the enqueue-launched turn instead of rejecting with prompt.not_found when no prompt is pending at steer time - report steer as queued when a manual compaction holds the context - sync title/lastPrompt metadata on main-agent steer, matching v1 - update the v1-v2 parity test to assert converged behavior	2026-08-11 14:40:15 +08:00
Haozhe	2acf22f66e	refactor(agent-core-v2): invert sessionLifecycle/MCP dependency via lifecycle event (#2803) ... - add onWillCreateSession to ISessionLifecycleService: a synchronous participation event fired before a session's services activate, exposing a session-domain facade (readSeed / contributeSeed / onSessionDispose) - workspaceMcp subscribes and activates ephemeral-server overlays itself: the configs travel as the new ISessionEphemeralMcpServers session seed, the stdio cwd is read from ISessionContext, the merged ISessionMcpHandle is contributed over the seed adapter's workspace projection, and the overlay shutdown is attached to the session's teardown - sessionLifecycle drops its IWorkspaceMcpService dependency, the overlay tracking map, handle-dispose wrapping, and the dispose backstop - rename ScopeOptions.extra to seeds and ScopeOptions.assemble to configureContainer	2026-08-11 12:31:47 +08:00
Haozhe	0401ec4286	refactor(agent-core-v2): extract btw into a features/btw Feature unit (#2724) ... - move session/btw to features/btw, mirroring the plan feature layout - contribute ISessionBtwService at Session scope through BtwFeature (contributeService) instead of a static registerScopedService call - keep the package root exports unchanged; move the test to test/features/btw	2026-08-10 11:09:23 +08:00
oocz	01c74e9372	fix(agent-core): isolate builtin profile catalogs per session (#2740)	2026-08-08 14:26:17 +08:00
Liu Zhongnuo	437a1b8ba1	fix(sdk): probe MCP auth status through connection (#2731)	2026-08-07 22:18:53 +08:00
Liu Zhongnuo	0b2e803d5e	feat(sdk): expose global MCP auth status (#2706)	2026-08-07 13:11:18 +08:00
Haozhe	7cd64766c8	feat: isolate the full-text search index from the session index and the main thread (#2701) ... * feat(minidb): instrument open lifecycle with phase timings and status Add MiniDb.lifecycleStatus() exposing the no-generation/generation-load/ wal-catch-up/full-rebuild/ready/degraded state machine plus per-phase timings (generation candidate load, store/non-text/text image load, postings integrity check, WAL scan/apply, full recovery, text rebuild hosting), so snapshot load, WAL catch-up and full rebuild can be told apart in diagnostics. Also add a repeatable open-lifecycle bench (small data, large WAL delta, large full-text generation, corrupt generation) and fixtures proving a healthy generation open performs no full-corpus tokenization while a corrupt or missing generation falls back. Log search-index and query-store open diagnostics in kap-server and agent-core-v2 so a listSessions call can be attributed to the database it touches. No persistence format or product behavior change. * feat(agent-core-v2): isolate the session index from the global search index Harden the separation between the session read model and the full-text search index so session operations never depend on search availability: - Reject text index definitions in MiniDbQueryStore at definition level, keeping the session query-store a structural-only read model with no postings/tokenizer artifacts, and assert its generation carries no full-text files. - Share one authoritative scan between the first list and the initial projection (single-flight) instead of scanning twice; reads may only join an in-flight scan, and every fallback read folds the mirror's pending queue so read-your-writes holds while preparing. - Keep withReadModel() fallback semantics pinned by tests: uninitialized/preparing reads hit authoritative metadata immediately, ready reads use the read model, degraded keeps falling back with a diagnosable status reason. - Guard session metadata writes so a mirror failure degrades only the read model and never fails the session lifecycle. - Prove via tests that listSessions/--resume/--continue never open the global search DB (including when search-index is unopenable), and that only real full-text search requests report building/stale/degraded. * perf(minidb): slice open-time work so it never blocks the main thread Make the whole generation-open path cooperative: - Replace the synchronous postings/store CRC verification with chunked async variants (readGenerationFileCheckedAsync, verifyFileIntegrityAsync) that keep the exact bytes/crc-mismatch error semantics. - Give the WAL-delta apply a primitive-op + wall-clock budget (walApplySlicer), so a batch frame unrolling into thousands of ops can no longer run as one uninterruptible slice; torn-tail, corrupt-batch and read-only behaviors are unchanged. - Slice the big attach loops: Store.bulkLoadRefsAsync + SkipList.bulkLoadAsync for the store image, async parsers and loadImageAsync for secondary/compound images, and TextIndex.attachImageAsync for the docs/dictionary map construction. - Queue text builds on worker-slot pressure (WorkerSlots.acquireBounded, bounded by MiniDb.textBuildSlotWaitMs, abort-aware) instead of falling back to an unbounded inline build; a persisted drought hosts the bounded inline core as the explicit last resort with stats accounting. Bench (bench/open-lifecycle, seed 42): event-loop delay max across the four open scenarios drops from 45/734/331/492 ms to ~12-28 ms with wall time flat or better. * feat(kap-server): run the global search index in a dedicated worker Move the whole search-index MiniDb lifecycle (open, generation load, WAL replay, sync, rebuild, compaction) off the main thread into a long-lived worker_threads host, so it never shares the event loop with TUI input: - Add a versioned request/response protocol and worker entry hosting a host-agnostic SearchIndexCore; the same core also backs an inline backend kept as the explicit rollback (KIMI_CODE_EXPERIMENTAL_SEARCH_WORKER=false, flag default ON). - The worker exclusively owns the search-index handle. The lock token is reported at acquire time (new MiniDb OpenOptions.onLockAcquired hook) and reaped on dirty exit; an orphan-lock detector (same-pid lock row whose token no live holder owns) recovers the window where the token report is lost, so a mid-open crash can never freeze the index into a silent permanent read-only. - Crash handling: in-flight requests are rejected with typed errors, respawn uses capped exponential backoff, per-request watchdogs terminate wedged workers, and beginClose propagates into the worker so dispose stays bounded during a long sync. Page tokens pin a boot-salted generation, so tokens issued before a transparent worker restart fail closed with invalid_page_token. - The main process keeps the sync coordinator (debounce/coalescing/ single-flight), live transcript routing, query normalization and page-token codec; searches keep reading the published generation and report building/stale/degraded instead of waiting for sync/rebuild. - Wire the worker into the CLI packaging: self-contained worker bundles for npm dist and the SEA asset manifest/installer/smoke check, plus a dev runtime (type-stripping + .ts resolve hook) scoped to worker execArgv. * feat(kap-server): model search and session-index lifecycles explicitly Consolidate the two-index separation into explicit, diagnosable lifecycles: - Surface the global search state machine (stopped / opening / building / ready / degraded / closing) end to end: SearchIndexCore.lifecycleState, SearchWorkerHost lifecycle snapshots cached from RPC responses (and invalidated across worker generations), a never-throwing status() carrying the lifecycle, and a synchronous lifecycleReport() that neither kicks the open nor spawns the worker. Corrupt search-index rebuilds are announced with a dedicated warn log so building, stale, degraded, corrupt and worker-unavailable stay distinguishable. - Turn MiniDb read-only replica catch-up fully cooperative: catchUpWalAsync scans frames with the windowed async scanner and yields per primitive op on the shared walApplySlicer budget, while a per-instance catchUpChain serializes concurrent catch-ups so each caller keeps its atomic watermark advance. The stale synchronous implementations are removed. - Pin the dependency direction and availability timing with tests: session list/create/resume survive a corrupt or unopenable search index (also end-to-end with a dead query-store), search generation reuse and stale-serving keep working across restarts, concurrent cold callers open the index / spawn the worker exactly once, resume-then- fetchSessions performs no duplicate authoritative scan, and a clean dispose releases the lock and settles at stopped. - Document the experimental flag surface (persistence_minidb_readmodel, search_worker) in the root guide. * feat(agent-core-v2): default the session read model on and roll out the separation Rollout and validation for the index separation plan: - Flip persistence_minidb_readmodel to default ON (rollback via KIMI_CODE_EXPERIMENTAL_PERSISTENCE_MINIDB_READMODEL=false or the experimental config section); session list/--resume/--continue now always go through the isolated session read model with the authoritative fallback. Test harnesses pin the flag off where shared fixtures require hermetic homes, while the dedicated suites keep explicit on/off coverage. - Add a probe proving the main thread stays responsive while the search worker rebuilds and swaps a generation (reindex), completing the TUI responsiveness matrix. - Record the rollout state in the agent-core-v2 guide (session index section) and the root flag line. - Add changesets for the CLI (worker isolation, session index independence) and minidb (cooperative open lifecycle). Validation: full suites green across minidb (551), agent-core-v2 (4760), kap-server (1005), node-sdk (343), klient (91) and the CLI app (2567); open-lifecycle bench event-loop delay max is down from 45/734/331/492 ms to ~16-22 ms across the four scenarios with wall time flat or better. * fix(agent-core-v2): evict deleted sessions from the mirror queue and drain the index on close Two issues surfaced by the read-model default in the acp-server suite: - ISessionIndex.remove only deleted from the query store, but a summary still queued in the mirror was folded back into reads (and re-written by the next flush), resurrecting a deleted session in listings. The mirror now exposes evict(id): drop the queued summary and wait out an in-flight flush before the store delete. - RunningAcpServer.close and SDKRpcClientV2.close disposed the engine without awaiting the asynchronous mirror flush / query-store close, so a host removing homeDir right after close() raced in-flight shard closes (ENOTEMPTY). Both now follow the kap-server shutdown order: drain the mirror while the store is open, dispose, then await the drains. * fix(minidb): pause active expiry during the sliced bulk load The store's active-expire timer is armed at construction, so during a sliced bulkLoadRefsAsync a tick can fire mid-load: it reaps a TTL key from the map while the order skiplist is still the old empty one, and the final bulkLoadAsync then rebuilds order from the stale orderEntries snapshot — resurrecting the expired key in the ordered index (and duplicating it if the key is later set again). The sync bulkLoadRefs had no yield windows, so guard the async path with a bulkLoading flag that defers expiry ticks until the load settles (finally-safe). * chore: consolidate changesets into the TUI startup freeze fix	2026-08-07 07:38:16 +08:00
Haozhe	c0b61c6e55	fix(agent-core-v2): count compaction tokens on the full-request basis (#2699) ... - tokensBefore/tokensAfter now include the system prompt and non-deferred tool schemas, matching the measured-anchor basis the context gauge uses between exchanges - the post-compaction ledger rebase carries the same full-request size, so the reported context size no longer dips to a messages-only estimate and jumps back on the next exchange - the PreCompact hook tokenCount uses the same basis	2026-08-07 07:31:11 +08:00
github-actions[bot]	f0614c53e5	ci: release packages (#2641) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-06 21:56:49 +08:00
Haozhe	794714ebef	fix(agent-core-v2): gate plugin changes behind session baselines and reminders (#2702) ... * fix(agent-core-v2): gate plugin changes behind session baselines and reminders - capture a per-session MCP server baseline (ISessionMcpHandle.isBaselineServer) so servers added mid-session (plugin install, mcp.json edit) never register tools in live sessions; they take effect on /new, /reload, or resume, while removed servers stay tombstoned and fail calls with a removal notice - stop rebuilding the system prompt on plugin-source catalog changes: the frozen skill listing and plugin sections cannot move anyway, and the rebuild only churned the ${now} timestamp, invalidating the provider prompt cache - freeze the Agent tool description's catalog profile list once the session catalog has loaded, keeping the tools payload byte-stable across mutations - append a plugin_change system reminder to live sessions on plugin mutations (new IPluginService.onDidMutate; explicit reloadPlugins does not raise it) - revert the TUI hint to "Run /new or /reload to apply plugin changes." and update the plugin/MCP docs and changesets to the corrected contract * fix(agent-core-v2): import LifecycleScope from app/scopes in sessionOutcomeMirror #2666 imported LifecycleScope from #/_base/di/scope, which does not export it (it lives in #/app/scopes), breaking the package build and typecheck on main. * fix(agent-core-v2): close the mutation-driven session-start refresh and overlay baseline leaks Codex review on the PR found two contract leaks: - a plugin mutation re-pulls the plugin skill source, and the existing catalog listener answered with a fresh plugin_session_start reminder — injecting the newly installed plugin's instructions into the live session alongside (and contradicting) the plugin_change notice. The session-start refresh now skips mutation-driven catalog changes (one per mutation, counted; explicit reloads keep the old refresh behavior). - a session created with ephemeral mcpServers kept its MCP baseline open until the overlay connect finished; a workspace server added in that window (plugin install, config edit) leaked into the live session through the merged view. The overlay handle's baseline now freezes on the workspace manager's initial load, with the ephemeral names baseline by construction. * fix(agent-core-v2): drop duplicate LifecycleScope import in sessionOutcomeMirror test --------- Signed-off-by: Haozhe <yanghaozhe@moonshot.ai>	2026-08-06 21:11:03 +08:00
qer	fa3325404b	fix(agent-core-v2): import LifecycleScope from the L3 scopes module (#2703) ... The L3 unit layer refactor moved LifecycleScope out of the _base DI kernel into the app tier, leaving the session outcome mirror with a stale import that broke typecheck and import-time evaluation on main.	2026-08-06 20:56:54 +08:00
qer	335588e259	feat(agent-core-v2): persist the last turn outcome into session metadata for cold listings (#2666) ... * feat(agent-core-v2): persist the last turn outcome into session metadata for cold listings A cold session (no live handle) reported no lastTurnReason, so after a server restart the session list could not mark a session whose last turn failed until it was opened and resumed. A new Session-scope SessionOutcomeRecorder subscribes to the activity aggregate's turn_ended changes and persists the outcome (completed/failed) into the session metadata document; the summary pipeline (mirror + cold reader) carries it as SessionSummary .lastTurnReason, and toWireSession falls back to it when no live fact exists. 'cancelled' is deliberately not persisted: it is also what an in-flight turn ends with during scope disposal, and writing there races the host's home-dir teardown. Verified end to end with an isolated home and a dead provider: a turn fails, the server restarts, and GET /sessions reports last_turn_reason=failed without opening the session. * fix(klient): carry lastTurnReason/lastTurnOutcome in the validated contracts Review follow-up: zod strips unknown keys on parse, so the new outcome fields never reached klient callers; add them to the session summary and metadata/patch/key schemas (contract parity test covers the engine mirror). * fix(agent-core-v2): persist user-cancelled outcomes, never teardown aborts Review follow-up: skipping every 'cancelled' left a stale earlier outcome in the metadata (e.g. a prior failed reported for a session whose latest turn was stopped by the user). The recorder now subscribes to the main agent's turn.ended facts directly and keys on interruptReason: user_cancelled is persisted like any other terminal state, while programmatic aborts — including the cancel every in-flight turn suffers during scope disposal — are never written, so no metadata write races the host's home-dir teardown. * fix(kap-server): only fall back to the persisted outcome for cold sessions Review follow-up: a warm session that just started a new turn clears its live lastTurn, and the unconditional ?? fallback would then report the previous turn's persisted outcome for a turn that is still running. SessionFacts now reports whether a live handle exists, and the wire projection only reads the persisted value when the session is cold. * docs(agent-core-v2): keep the outcome-recorder header at role level * fix(agent-core-v2): settle turn outcomes on turn start and drain metadata writes on close Review follow-ups: - a new main turn now clears the persisted outcome (turn.started), so a process that dies mid-retry no longer reports the previous turn's terminal state for a turn that never ended - the dedupe marker only advances after a successful write, so a failed persist no longer suppresses the next identical outcome - session metadata writes are tracked in a module-level pending set with drainSessionMetadataWrites(), awaited by kap-server close alongside the mirror/query-store drains — an event-driven write (e.g. the outcome recorder) can no longer land in a session dir while the host removes it * fix(agent-core-v2): track the metadata dispose flag locally Disposable exposes no public isDisposed accessor; keep a class-local flag set in the dispose override. * fix(kap-server): drain session metadata writes before the mirror and disposal A write still in flight when close() begins must settle before the mirror flushes its summary into the read model and before scope disposal marks the service disposed — not after. * fix(agent-core-v2): reattach the recorder when the main agent is recreated Review follow-up: a failed bootstrap still fires onDidCreate before the handle is dropped; the subscription then pointed at a dead bus and the guard blocked any later reattach. Track onDidDispose and reset so the next main creation attaches cleanly. * test(agent-core-v2): resolve the recorder through the scoped DI harness Review follow-up: construct SessionOutcomeRecorder via registerScopedService + a Session-scope test host (stubbed lifecycle/metadata), so the test covers the production registration path; add the durable-value adoption case. * fix(agent-core-v2): unbreak CI — iterable Promise.all and the debug channel surface - Promise.all takes the pending-writes set directly (oxlint error) - the disposed flag moves into a _register'd marker instead of a public dispose() override, which the debug channels listing (and its test) correctly rejects as framework plumbing * fix(kap-server): surface persisted failures on the v2 session status The v2 list folds the outcome into activity.status, which previously read only live facts — a cold session always looked idle. Cold sessions now map a persisted failed outcome to status 'failed' (completed and cancelled stay idle, matching the live fold); warm sessions are unchanged, and the statuses filter inherits the mapping. * refactor(agent-core-v2): name the persisted field lastTurnReason Aligns with the established name for the same concept end to end (activity view's lastTurnReason, the v1 wire's last_turn_reason, and the SessionSummary mirror), instead of introducing a third variant. * fix(agent-core-v2): drain pending metadata writes before session teardown Review follow-up: closing/archiving a session right after a turn ended could dispose the scope while the outcome write was still queued, and delete() removes the session dir immediately after close. Await the pending metadata writes before the handle goes away. * fix(node-sdk): carry lastTurnReason through the SDK session summary Review follow-up: the in-process SDK path maps the engine summary through v2SummaryToSessionSummary, which dropped the new outcome field. Add it to the public SessionSummary type and the mapper; the parity gate projects it away (the v1 engine never records an outcome). * fix(node-sdk): populate lastTurnReason on live SDK summaries Review follow-up: resumeSession/reloadSession build their summary from the live session's metadata document, which now carries the outcome — surface it there too so the SDK reports it consistently for live and listed sessions. * fix(agent-core-v2): carry the last turn outcome across session forks Review follow-up: fork skips state.json when copying the session dir, so the fork's fresh metadata never had the outcome and a restart dropped a marker the warm fork was still reporting. The fork's metadata patch now inherits the source's lastTurnReason. * fix(agent-core-v2): settle pending outcome writes before reading a fork source Review follow-up: a fork requested right after the source's turn ended could read the metadata before the recorder's queued write landed, inheriting a stale or absent outcome. Drain pending metadata writes first. * fix(agent-core-v2): backfill restored outcomes into the session metadata Review follow-up: for sessions whose last turn ended before this field existed, the cold-resume seed restores the outcome into the activity view without a turn.ended fact, so the recorder never persisted it and cold listings stayed blank. The recorder now also watches the main agent's activity updates and backfills the restored outcome when nothing is persisted yet. * fix(agent-core-v2): never backfill restored cancellations Review follow-up: a restored 'cancelled' cannot be told apart from a programmatic abort (the activity event carries no interruptReason), and those are never persisted. Backfill now covers only completed/failed; user stops are still persisted from the live turn.ended fact. * refactor(agent-core-v2): rename the outcome recorder to outcome mirror Mirror is the codebase's established term for a write side that reflects live state into a store (SessionIndexMirror); Recorder has no precedent. * fix(agent-core-v2): backfill without bumping recency; header-only comments Review follow-ups: - a mere resume must not float an old session to the top of the list: metadata updates accept touchUpdatedAt:false and the outcome mirror's backfill uses it (live outcome writes keep bumping — turn end is a recency moment) - the mirror service's inline notes move into the file header per the package comment convention - drop the redundant |undefined from the SDK's optional outcome field * fix(node-sdk): read the live outcome for resumed session summaries Review follow-up: on a fresh resume the restored outcome can still be queued as a metadata backfill, so the document may lag a tick; the live activity aggregate already holds it. Resume/reload summaries now prefer the live value and fall back to the metadata field. * fix(agent-core-v2): confine the outcome backfill to pure resumes Review follow-up: the view publishes its turn.ended fold before this mirror's own turn.ended handler runs, so a live ending reached the backfill branch first and got persisted without the recency bump. The backfill now only applies when no turn ever started in this process — live endings always take the bumped write. * fix(agent-core-v2): drain the session-index mirror before session teardown Review follow-up: settling the metadata write alone left the fresh summary in the mirror's pending queue, so a list right after close could read a stale outcome from the read model. close/archive now also drain ISessionIndexMirror. Test harnesses register a mirror stub for the new dependency. * docs(agent-core-v2): fold the metadata drain contract into the file header * chore: include the SDK package in the changeset; fold the drain note into the header * fix(agent-core-v2): backfill restored cancellations too, quietly Review follow-ups: dropping every restored cancel loses legitimate user stops whose live write never landed (or was rejected) before a restart — cold surfaces never mark cancelled anyway, so healing them is harmless and strictly more accurate. The metadata disposal note moves into the file header per the comment convention. * fix(node-sdk): prefer the live outcome over the index in SDK listings Review follow-up: a live session that just started a new turn after a failure can briefly keep the stale outcome in the index while the mirror's clear is queued. listSessions now reads the live activity aggregate for warm sessions, matching the kap-server cold-only fallback. * fix(node-sdk): never read the metadata outcome for a live session Review follow-up: with a retry in flight the live aggregate has no outcome while the document may still hold the previous failure — the fallback showed the stale one. Live summaries now take the live aggregate's answer alone; the restored outcome is already seeded there on resume.	2026-08-06 20:14:05 +08:00
Haozhe	02c026d487	feat(agent-core-v2): tombstone removed MCP servers and freeze plugin prompt inputs (#2694) ... * feat(mcp): tombstone removed MCP servers and apply plugin changes immediately (20 files) - add 'removed' MCP server status: workspace config removals call markRemoved instead of remove, keeping tool registrations alive while short-circuiting calls with a removal notice - fire onDidReload after every plugin mutation (install/enable/disable/remove) so workspace consumers refresh contributions immediately - TUI renders the removed status in the MCP panel/startup summary and shows an apply-immediately hint on the v2 engine * feat(agent-core-v2): freeze plugin prompt inputs for live agents (2 files) - snapshot the model skill listing and plugin system-prompt sections on the first successful prompt build and reuse the frozen values for the agent's lifetime, so plugin install / enable / disable / remove / reload never rewrites a live agent's prompt (same keep-live-sessions-stable philosophy as the MCP tombstone) - freeze only on success: a not-yet-ready skill catalog or a failed enabledSystemPrompts() read must not pin empty values for the agent's lifetime - refreshSystemPrompt still rebuilds on catalog change events but reuses the frozen values, so the prompt only moves when non-plugin inputs change (AGENTS.md, [tools] section, session tool policy, compaction); new agents snapshot the then-current state * chore(changeset): add changesets for MCP tombstone and frozen plugin prompt inputs * docs: describe immediate plugin changes and the removed MCP status on the v2 engine * fix(klient): mirror the removed MCP server status in the wire contract * docs: drop the legacy-engine behavior notes from the plugin and MCP pages * fix(agent-core-v2): freeze plugin sections only on a loaded snapshot - enabledSystemPrompts() resolves to its consumption fallback (never rejects) while the initial plugin load has failed; freezing that empty read locked plugin sections out of the live agent even after a later successful reload - expose hasLoadedSnapshot() on IPluginService so resolvePluginSections can tell a real empty snapshot from the fallback before freezing	2026-08-06 19:19:51 +08:00
liruifengv	cfd14a1fe2	feat(kap-server): accept attachments on skill activation (#2693) ... * feat(kap-server): accept attachments on skill activation The :activate endpoint only took {args?}, so REST clients (web/desktop composers) could not attach uploads to a /skill invocation — attachments were silently dropped at the edge. - activateSkillRequestSchema gains an optional attachments field carrying the image/video/file subset of the prompt content wire shape. - The skills route resolves them through the same edge pipeline as prompt submissions (validate file refs → materialize/compress → convert), extracted from routes/prompts.ts into lib/promptMedia.ts. - AgentSkillService.activate appends the resolved parts after the rendered skill prompt in the activation's user message; SkillActivationInput gains an optional content field. The native RPC/TUI path is unchanged. - Attachment failures map to 40407 file.not_found / 40001 validation.failed, mirroring the prompts route. * fix(kap-server): drop the unused parseKimiFileUrl import in promptMedia * refactor: address review — header-only comments in the skill domain, provider id on protocol URL sources - agent-core-v2 keeps comments solely in the top-of-file block (scoped guide): SkillActivationInput.content documented in the skill.ts header, the activate() note folded into the skillService.ts header. - packages/protocol's image/video URL source gains the optional provider-issued id, matching the kap-server wire schema so parsing the public contract no longer strips it. * fix(kap-server): validate the skill before materializing activation attachments An unknown or non-user-activatable skill name with attachments ran the media pipeline first, streaming bytes into the session/cache dirs and compressing images for a request that activate() would reject with 40415/40912. The route now checks the session catalog up front (the service still re-validates) so invalid activations leave no disk or CPU side effects.	2026-08-06 19:09:32 +08:00
Haozhe	4d39f4fa6f	fix(agent-core-v2): omit max_context_tokens in REST session status when unknown (#2696) ... - align the REST status rollup with the WS push: a bound alias that no longer resolves omits max_context_tokens instead of reporting 0 (0 is the engine's UNKNOWN_CAPABILITY marker, not a real limit) - fall back to the default model's limit only when no model is bound, resolved through IModelService like the WS side - mark max_context_tokens optional in the shared session status schema	2026-08-06 18:50:16 +08:00
Haozhe	8c766a6c30	feat(agent-core-v2): add the L3 unit layer and the Feature seam (#2678) ... * feat(agent-core-v2): add the L3 unit layer and the Feature seam - introduce the L3 Service/Fiber unit layer: the Service base class with this.provide/effect/on/get/ref capabilities, the fiber runtime with thenable FiberHandles, collection contribution points, and the per-scope-kind ScopeUnits materialization fold - provide each scope's static registration batch as one atomic provideAll cascade transaction (waiting-area activation, sticky Failed on construction error) - add the DI unit inspection surface: App-scope debug ledger / dependency graph / cascade history services and the kimi-inspect DI view - add the Feature unit seam (IFeatureManager + feature assembly), port plan mode onto it, and add the contributed-command seam (agent-command domain + node-sdk RPC types) - remove the legacy dep-graph tooling - apply the header-only comment convention across src and test: strip non-header narration, keep the file header, tooling pragmas, and NOTE comments * feat(kap-server): gate the event.di.* debug feed to kimi-inspect connections - add an opt-in target set in SessionEventBroadcaster; the global fan-out now skips event.di.* frames for connections that never opted in, so kimi-web and other clients no longer receive the high-churn DI feed - WsConnectionV1 opts a connection in when client_hello carries client_id 'kimi-inspect'; removeGlobalTarget drops the opt-in on close - temporary gate until a client-declared event-type whitelist lands * chore(agent-core-v2): fix oxlint errors in the DI unit layer - build the live-ref container chain without aliasing this (no-this-alias) - snapshot the materialized map with Array.from and document why the copy is required (no-useless-spread) * test(klient): use string scope kinds in the lifecycle handle fakes The engine's LifecycleScope is a string enum now; the facade test doubles still returned the old numeric kinds and failed the handleWireSchema output validation. * build(nix): update the pnpmDeps fetch hash	2026-08-06 18:22:36 +08:00
qer	ef61084009	fix(kimi-code): select compatible PowerShell for Computer Use (#2686) ... * fix(kimi-code): select compatible PowerShell for Computer Use * fix(kimi-code): handle locked Computer Use plugin files * fix(kimi-code): align Windows Computer Use name * fix(agent-core-v2): reuse PowerShell fallback for detection * fix(agent-core-v2): refresh ready Computer Use plugin	2026-08-06 18:08:28 +08:00
liruifengv	7b2784b9b7	feat: surface the bound model and thinking effort on subagent UIs (#2679) ... * feat: surface the bound model on subagent UIs The subagent.spawned event now carries the display-normalized model alias (the derived __secondary__ entry resolves to its base alias), so clients can show which model a subagent is bound to. The TUI subagent card, swarm panel header, and background-agent entry show it at spawn; the WS snapshot roster and REST /tasks (background/detached subagents) carry it too, keeping the model visible across client reconnects. * feat: carry the subagent thinking effort alongside the model The spawned event, snapshot roster, and REST /tasks now also carry the child's effective thinking effort (read from the child profile at spawn, the same vocabulary as agent.status.updated). UIs show it only when it diverges from the main session's current effort — an inherited level adds no information, and 'off' is never shown. * feat(tui): show the bound model and effort in the /tasks browser The task browser's Detail pane renders Model and Effort rows for agent tasks (raw alias and level — it is the inspector surface, so no diff filtering), and its minimum height grows to fit the new rows. The values were already persisted on SubagentTaskInfo; the TaskInfo union, its zod schemas (protocol, kap-server, klient contract), and the v1 type declaration now carry them so nothing strips them in transit. * feat(tui): show concrete subagent effort levels unconditionally Display rule simplified: any concrete effort tier (low/high/max/…) is shown next to the model — including when it matches the main session's level. Only the boolean states stay hidden: 'off' (no thinking) and 'on' (generic thinking) carry no level information. * docs: trim the changeset entry * fix(tui): keep the model and effort on background-agent entries across resume replayBackgroundProjection only copied agentId/parentToolCallId/ description, so a background subagent that outlived a resume lost its model/effort on the later terminal transcript entry. The projection now threads the persisted values (catalog-mapped model; boolean effort states dropped), and session replay passes the loaded model catalog through. * fix(agent-core-v2): normalize the derived secondary alias regardless of the flag A child bound while the secondary-model experiment was on keeps __secondary__ in its persisted binding; if the flag is later switched off with the recipe still configured, resolveSecondaryModel() gated the normalization and the sentinel leaked back onto resumed subagents. subagentDisplayModel now reads the recipe straight from config (the flag gates new bindings, not the interpretation of existing ones), which also drops SessionSwarmService's now-unused IFlagService dependency. Also adds the SDK package to the release: the new SubagentSpawnedEvent/AgentTaskInfo fields are SDK-visible types. * fix(agent-core-v2): normalize the status-frame model at the source A derived-bound child republishes agent.status.updated right after spawn with its raw modelAlias, which overwrote the spawned event's normalized display model on single-subagent cards (swarm headers were first-wins and escaped). emitStatusUpdated now maps through subagentDisplayModel, a no-op for the never-derived main agent. Also moves the inline comments added by this branch into top-of-file headers per the v2 comment convention. * fix(tui): clamp the /tasks detail frame to the available body At terminals near the minimum height the forced 10-row detail frame overflowed the body and truncated the preview frame's border. The detail height now caps out at whatever leaves the preview its borders plus one content row, with a regression test at exactly MIN_HEIGHT. * fix: normalize inherited derived aliases and keep model/effort on replayed terminal entries - resolveSubagentBinding's caller-fallback branch also maps through subagentDisplayModel: a caller itself bound to the derived entry (a resumed subagent making a nested Agent call) no longer publishes __secondary__. - The replayed background-task terminal notification builds its metadata with the persisted model (catalog-mapped) and concrete effort, matching the live completion path. - Drops the inline comments this branch added inside v2 test bodies; the scenario context lives in the source file headers.	2026-08-06 16:59:45 +08:00
qer	013203421d	fix(tui): surface capability install errors (#2682)	2026-08-06 14:02:59 +08:00
Haozhe	34c4181437	fix(kimi-code): keep kimi -p alive while background tasks are pending (#2675) ... The 10-year default print wait ceiling (315360000s) overflowed Node's setTimeout limit (2^31-1 ms) into a 1ms fire, so the steer/drain wait returned instantly and kimi -p exited right after the main turn, killing pending background tasks and subagents. - add setClampedTimeout in agent-core-v2 _base, clamping delays to MAX_TIMER_DELAY_MS, and route every config-driven timer through it (timeoutOutcome, task wait/manager timeout, swarm attempt timeout) - chunk the print turn-endings wait against the real deadline instead of returning null on the first clamped timer fire - restore v1 semantics: a non-positive swarm subagent timeout is unbounded - default print_wait_ceiling_s to 2147483s (~24.8 days, the timer maximum)	2026-08-06 11:02:34 +08:00
Haozhe	7bd3fd9f6e	feat(agent-core-v2): read UTF-16 text files by transcoding to UTF-8 (#2647) ... - detect UTF-16 LE/BE from a BOM or a zero-byte parity heuristic (tolerant of CJK content), derived from VS Code's encoding detection - Read tool and workspace fs.read transcode UTF-16 text to UTF-8 instead of refusing it as binary; larger than 10 MiB still refused - refuse other non-UTF encodings (e.g. GBK) with a clearer message	2026-08-06 10:39:21 +08:00
qer	d1ded01b7c	fix(agent-core-v2): seed the activity view's lastTurn from the persisted turn.ended record (#2648) ... * fix(agent-core-v2): seed the activity view's lastTurn from the persisted turn.ended record A cold-resumed agent seeded its activity view only from live loop/task state, so the last turn's outcome was lost on a server restart: sessions came back with no lastTurnReason, and clients could not surface a previously failed turn (e.g. a provider 429 that killed the turn before the restart). The loop already persists the terminal turn.ended record (reason, error, durationMs); fold the latest one into the TurnModel as lastEnded and have AgentActivityView.seedFromLoop adopt it when no turn is active, so the session work aggregate (and everything built on it) reflects the last turn's outcome again after a cold start. * fix(agent-core-v2): seed lastTurn on wire restore and add a changeset Review follow-up: the agent scope (and with it this view) is constructed before wire.restore() replays the journal, so a constructor-time read of TurnModel.lastEnded always saw the initial state on a cold resume. Move the wire-backed seed behind the onDidRestore hook (constructor seed kept for views built after a restore), and drop the inline comments in favor of the file header per the package comment convention. * docs(agent-core-v2): trim the activityView header to role and collaborators Review follow-up: the previous revision narrated the restore-hook mechanics in the header; the package convention keeps headers at the module's external role plus collaborators, so drop the implementation narrative. * fix(agent-core-v2): keep TurnModel.lastEnded across clock advances Review follow-up: advanceTurnClock built a fresh state object without spreading, so a new prompt or a queued cancel silently dropped the stored last-ended outcome even though no new turn had ended — after a restart the activity view would again find nothing to seed. Spread the prior state and cover the prompt/queued-cancel/replace cycle with a model-level test. * fix(agent-core-v2): clear the stored turn outcome once a newer turn starts Review follow-up: with the clock advances preserving lastEnded, a prompt persisted without its turn ever starting would leave the previous turn's outcome to be seeded after a restart, reporting a stale result for a turn that never ended. The loop-event fold now drops lastEnded as soon as a newer turn's events land, while prompts and queued cancels keep it. * docs(agent-core-v2): keep the turnOps header at the domain role Review follow-up: the lastEnded keep/clear mechanics read as implementation narrative in the header; the convention there is role and collaborators only.	2026-08-06 01:07:22 +08:00
qer	68ba740ebf	feat(kimi-code): support Kimi Computer Use on Windows (#2652)	2026-08-05 21:15:02 +08:00
Haozhe	2b893733f9	fix(kap-server): bypass Node arg quoting for explorer /select, on Windows (#2645) ... explorer.exe parses its raw command line rather than argv, so Node's default spawn quoting breaks the `/select,` argument whenever the path contains spaces: the command line becomes `"/select,\"C:\...\""`, which explorer rejects, silently opening the Documents folder instead of selecting the file. Quote only the path portion and launch with windowsVerbatimArguments so the command line keeps the documented `/select,"C:\some dir\f.txt"` form.	2026-08-05 20:15:27 +08:00
Haozhe	510fbe7ec5	refactor(kap-server): wrap /api/v2/sessions in the v1 response envelope (#2644) ... - return the domain-grouped page payload inside { code, msg, data, request_id } and carry business outcomes in code (40001 invalid params with details, 40922 page_token mismatch) instead of raw HTTP statuses plus an { error: { code, message } } body - add ErrorCode.PAGE_TOKEN_MISMATCH (40922) - register the route via defineRoute (shared runtime validation and envelope-wrapped OpenAPI docs); fold include-domain validation into the query schema and replace the preprocess/doc-twin pair with scalar-or-array union params - update the kimi-inspect client to unwrap the envelope and sync the two AGENTS.md guides	2026-08-05 18:20:00 +08:00
Haozhe	6f1cd7ca22	feat: add v2 sessions API and spreadsheet-like session table in kimi-inspect (#2640) ... - kap-server: add GET /api/v2/sessions with a domain-grouped response (workspace / meta / activity, opt-in git), status / archived / updated_after filters, three sort orders, and fingerprint-bound opaque cursor pagination - kimi-inspect: rebuild the chat sidebar as a spreadsheet-like session table on the v2 endpoint — preset views (All / Opened / Archived / By workspace / Git), column visibility config, header sort toggles, cursor-paged Load more, and localStorage-persisted panel prefs - live activity frames from the WS hub override the REST status badge; session created / meta-updated events invalidate the v2-sessions query	2026-08-05 17:28:11 +08:00
github-actions[bot]	53c832dfdf	ci: release packages (#2592) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-05 16:21:32 +08:00
liruifengv	421e8f8065	fix(minidb): silence the transform-types warning from the dev worker (#2632)	2026-08-05 15:53:13 +08:00
qer	75fe068a01	fix(cli): stabilize built-in capability installation (#2601) ... * fix(cli): show built-in capabilities before the first session exists The lazy-session refactor left capability calls going through requireSession(), so on a session-less v2 startup /plugins reported the capabilities unavailable and hid the built-in rows behind the promo. Like plugin management, capability readiness and installs are app-global on the v2 engine: the node-sdk harness gains a capability facade over the global channel, and the TUI resolves session-or-harness for every capability call. * fix(cli): count the dev marketplace server as the default catalog dev.mjs always points KIMI_CODE_PLUGIN_MARKETPLACE_URL at its own repo-serving server, which the override gate mistook for a user-configured marketplace and suppressed the built-in capability rows in every dev run. The dev server now marks itself, and the gate treats that marked URL as the default catalog while still honoring real overrides (slash-command source, user-set env, KIMI_CODE_DEV_MARKETPLACE_URL). * fix(cli): align built-in capability updates	2026-08-05 14:55:04 +08:00
Haozhe	f881cdd970	feat(cli): default CLI surfaces to the agent-core-v2 engine (#2627) ... * feat(cli): default to agent-core-v2 engine with KIMI_CODE_LEGACY_FLAG opt-out - invert the engine gate: isKimiV2Enabled() now returns true unless KIMI_CODE_LEGACY_FLAG is truthy; KIMI_CODE_EXPERIMENTAL_FLAG no longer selects the engine - replace the experimental `kimi acp-v2` command with the native v2 implementation as the default `kimi acp`; the legacy acp-adapter path remains under the legacy flag - drop the acp-v2 experimental flag from the registry - rename the dev:cli:v2 script to dev:cli:legacy - update en/zh docs for the new default engine and the legacy flag * feat(cli): route export and provider through the engine gate - select the harness via isKimiV2Enabled(): agent-core-v2 by default, the legacy harness when KIMI_CODE_LEGACY_FLAG is truthy - close the harness after each one-shot command so the v2 engine's watchers do not keep the process alive - document both commands in the KIMI_CODE_LEGACY_FLAG env-var entry	2026-08-05 14:42:23 +08:00
7Sageer	e3570280bd	fix(agent-core-v2): bound the project skill-root watch fd footprint (#2612) ... * fix(agent-core-v2): bound the project skill-root watch fd footprint The workspace skill-root source recursively watches the skill-root candidates with chokidar, which holds one fs.watch fd per file and per directory on macOS. A skill bundling a large runtime tree can exhaust the process fd budget and break every subsequent spawn (EBADF). Mirror the scanner's own pruning (node_modules / dot entries, scan depth cap) in the watch filter, and add a signal mode to hostFsWatch: rescan-style consumers get ONE native recursive fs.watch on darwin/win32, whose fd footprint is constant in the subtree size. * fix(agent-core-v2): align the skill watch with scanner semantics and harden signal mode Review follow-up: - The scanner probes every entry's direct SKILL.md before gating recursion, so the watch filter now keeps an excluded entry itself and its direct SKILL.md (keepEntryFile) instead of pruning them — skills under node_modules / dot directories keep their hot reload. - The signal-mode native leg now owns its recovery: a native watch error fires one root invalidation and re-arms with capped exponential backoff; chokidar is used only where recursive fs.watch is unavailable, so a transient failure can neither silently end hot reload nor downgrade to the per-node watcher. - Native event path resolution handles absolute filenames and the root-basename case, clamping out-of-root events to a root invalidation instead of dropping them. - The event mapping is extracted into NativeSignalMapper with the stat call injected, so the native-branch decisions are unit-tested on any platform. * Fix spawn EBADF issue on macOS for large file trees The skill watcher no longer opens every file it watches, improving performance. Signed-off-by: 7Sageer <sag77r@hotmail.com> * fix(agent-core-v2): harden native signal watch recovery * fix(agent-core-v2): align skill watch with scanner traversal * fix(agent-core-v2): make skill watch handoff converge --------- Signed-off-by: 7Sageer <sag77r@hotmail.com>	2026-08-05 13:47:26 +08:00
Haozhe	2a4990182d	docs: slim root AGENTS.md, move deep package docs to package guides (#2626) ... - move the kimi-inspect, kap-server, transcript, and minidb project-map entries into new package-level AGENTS.md files - move the standalone Agent class rule to packages/agent-core/AGENTS.md - merge root-only agent-core-v2 facts (MCP persistence, trust routes, seed contract examples) into packages/agent-core-v2/AGENTS.md - compress the remaining long project-map entries to summaries with pointers, and add an anti-bloat rule for map entries - drop the stale server-e2e entry; the package no longer exists	2026-08-05 13:43:33 +08:00
Haozhe	4e5f36aa66	test(agent-core-v2): stop the reconcile loop during the sessionIndex read baseline (#2625) ... The baseline gates warm reads on behavioral work counts, including zero directory listings inside each counting window. The service's background reconcile loop (60s interval) runs an authoritative scan on every tick — two storage.list calls — and once a slow CI runner stretches the test past that interval, a tick lands inside a counting window on every attempt and is attributed to the read under test, failing fsLists === 0 even with the retry (observed on run 30975794688: 168s across two attempts, fsLists = 2 both times). Freeze the loop right after prepare() via a new stopReconcileLoop() test hook (sibling of reconcileNow/reprojectNow). The only remaining directory listing sources inside a window are the fallback read paths themselves, so a non-zero count is deterministically a real regression again.	2026-08-05 13:43:22 +08:00
Kai	e7d5a0aee7	test(agent-core-v2): give the sessionIndex list baseline CI headroom (#2615) ... * test(agent-core-v2): give the sessionIndex list baseline CI headroom * test(agent-core-v2): retry the sessionIndex baseline once to absorb runner load spikes * test(agent-core-v2): gate the sessionIndex baseline on work counts, not wall clock The baseline asserted wall-clock medians (list < 300ms, get/count < 50ms) plus a relative time check — all still load-sensitive on shared CI runners. Replace every time assertion with behavioral complexity assertions recorded at the IQueryStore and fs seams: list must be served by bounded pageByColumn fetches only, get is a single point lookup, count never touches the session collection, no warm read enumerates session directories, and the per-op work snapshot must be identical at 1k, 10k, and 50k sessions. Medians are still logged for phase-to-phase comparison; the retry now absorbs a background reconcile tick landing inside a counting window. --------- Co-authored-by: haozhe.yang <yanghaozhe@moonshot.ai>	2026-08-05 10:59:28 +08:00
zy	2ee6e43124	fix(mcp): re-register the OAuth client when its redirect URI no longer matches (#2620) ... The callback listener binds a random port per flow, while DCR registration records the redirect URI of the flow that created it — so every interactive authorization after the first was rejected with "Invalid redirect URI", an error rendered only in the user's browser while the client waited for a callback that never came. Detect the mismatch before invoking auth() and drop the stale registration so the flow re-registers with the current callback URI (v1 + v2). Resolve #2606 Co-authored-by: zouying <zouying@moonshot.cn>	2026-08-05 10:24:24 +08:00
Kai	98ee35afd2	feat(agent-core-v2): add custom agent identity (#2573) ... * refactor(agent-core-v2): simplify context tags and shared copy Rename the context-injection tags to `<skill-loaded>` and `<plugin-instructions>`, drop the product prefix from the CronCreate tool description and the default agent description, and point the MCP OAuth callback page back to "your terminal" instead of naming one client. The callback page is shared by the ACP host, the web UI, and embedding hosts, so naming a single client was inaccurate there. The tags and the two descriptions read exactly the same without the prefix. Verified no runtime consumer matches the old tag names; the updated snapshots cover the tool descriptions that changed. * feat(agent-core-v2): add a switch for the product-documentation skills Five builtin skills document this CLI itself — `update-config`, `custom-theme`, `mcp-config`, `check-kimi-code-docs`, and `import-from-cc-codex`. Their names and descriptions sit in the system prompt on every turn, which is dead weight for runs that will never reconfigure the CLI. Add a top-level `builtin_product_skills` field (also settable through `KIMI_CODE_BUILTIN_PRODUCT_SKILLS`) to drop them. On by default, so nothing changes unless it is set; the trade when off is that the model loses the guided flows for those tasks. Filtering happens where the catalog is assembled — a later filter would leave the skills advertised to the model. The whole section is one scalar, so it exercises the section-level env binding branch and needs its own strip: `stripEnvBoundFields` only walks object fields, so an env override would otherwise be written back into `config.toml`. * feat(agent-core-v2): add custom agent identity Add an `[identity]` config section (`name`, optional `slug`, both also settable through `KIMI_CODE_IDENTITY_NAME` / `KIMI_CODE_IDENTITY_SLUG`) that sets the identity the agent presents: the name it calls itself in the system prompt, the `User-Agent` product token sent to third-party providers, and the client name announced to MCP servers. Leaving it unset changes nothing. Until now every one of these was fixed, which left no way to run the agent as part of another product — an internal deployment, a fork with its own branding, an embedding host. The identity resolves inside the engine rather than being seeded by each host, so it applies to every launch surface — including headless runs, which today seed no display name at all and fall through to the built-in default. Two deliberate asymmetries: - The display name is a filling value with a fallback chain (config > host-declared > the consumer's own default); the slug is a rewriting value with two states only, so with no identity configured the rewriting paths are equivalent to not existing. - The rewrite happens in the outbound header assembly, the one layer that knows which vendor it is building for. Vendors declaring `hostHeaders: 'full'` keep the host's own product token, which that header set is built around and which backends key on; the configured identity applies to the third-party path. Resolution is lazy throughout: config loads asynchronously, and a constructor snapshot would freeze the pre-load value under some startup orderings. Two input edges the resolver has to absorb, since both would otherwise reach the User-Agent builder and either break it or quietly rewrite the header: blank and whitespace-only values read as unset in the file just as they already did in the env, so a stray `name = ""` cannot claim an identity; and a name that folds away to nothing under slug normalization (a CJK-only name, say) falls back to a neutral token rather than producing a blank product, which the builder rejects. * fix(agent-core-v2): keep the file value when a scalar env binding fails to parse `config.ts` documents that an env value failing its binding's `parse` is ignored, and `applyEnvBindings` honors that for object fields by assigning only when the resolved value is defined. `applySectionEnv` returned the parse result straight through for whole-section scalar bindings, so a blank or mistyped variable resolved to `undefined` and cleared the configured file value instead of being ignored. Nothing hit this before: every existing section either binds object fields or is env-only. `builtin_product_skills` is the first whole-section scalar binding, where exporting an empty or misspelled `KIMI_CODE_BUILTIN_PRODUCT_SKILLS` would silently undo a configured `false`. * feat(agent-core-v2): extend the custom identity to discovery and global MCP Two outbound paths still announced the built-in product name under a configured identity: - `DiscoveryService` read the host User-Agent straight from bootstrap args when refreshing provider models, so custom registries — which are third-party endpoints — saw the original token while chat requests to the same class of endpoint saw the configured one. - `SDKRpcClientV2` builds its own global `McpOAuthService` plus a throwaway `McpConnectionManager` for server testing, neither of which goes through the workspace-owned manager that carries the resolver. Both now resolve the identity from the App scope. * refactor(agent-core-v2): neutralize remaining copy and align comments The synthetic MCP authentication tool description is injected into the model context and still named the product; it and the OAuth callback pages now use client-neutral wording. "Return to your terminal" was no improvement over naming a client — both assume what the host is, and that page serves the ACP host, the web UI and embedding hosts alike. Comments introduced by the identity work move into their module headers, per the domain convention. Interface field docs stay: the rule names functions, methods and statements, and field-level docs are established across the codebase. The new tests gain scenario headers and dispose the scoped hosts they create, and the `[identity]` docs state which engine reads the section. * fix(agent-core-v2): read the product-skill switch after config is ready `BuiltinSkillSource` is the lowest-priority skill source, so the workspace catalog loads it first — before `IConfigService` has finished loading — and keeps the contribution it returns for the life of the handler, with no reload path and no change event. Reading `builtin_product_skills` eagerly therefore stranded the startup configuration: an explicit `false` could be ignored for the whole process. `UserFileSkillSource` already awaits config readiness for exactly this ordering; this source now does the same. Also record the identity collaborator in the two module headers that gained the dependency without documenting it, and scope the `builtin_product_skills` docs to the engine that reads it, matching the note the identity section already carries. * fix(agent-core-v2): apply the product-skill switch to session-less listings `builtin_product_skills = false` only reached the scoped skill source. The SDK's `listWorkspaceSkills` and the server's `GET /workspaces/{id}/skills` both composed the raw `BUILTIN_SKILLS` constant, and the web app feeds its pre-session onboarding menu from that route — so the five product skills stayed listed until a session existed, then vanished from the session's catalog. Move the decision into `visibleBuiltinSkills(enabled)` next to the constant and route every consumer through it, reading the switch via the shared `builtinProductSkillsEnabled`. Keeping "what counts as a product skill" in one place is the point: three copies of the predicate would drift the next time a builtin is added. The SDK listing also awaits config readiness, which it did not do before. * fix(node-sdk): await config before materializing the global MCP OAuth provider `McpOAuthService` caches providers by store key and stamps the client name when it first builds one, and the preceding `globalMcpConfig.get()` reads `mcp.json` directly rather than through `IConfigService`. So a `beginGlobalMcpServerAuth` call made right after the harness is created could resolve the identity before config finished loading, pinning the built-in label for the rest of the process — including the OAuth dynamic registration a third-party MCP server records. `testGlobalMcpServer` already awaited config readiness for its own reasons; this path now does too. * refactor(agent-core-v2): drop the unused builtin-skill registrar `registerBuiltinSkills` stamped the raw constant into a catalog for "edge composition without a Session" — exactly the shape that now has to respect `builtin_product_skills`. It has no callers in v2 and is not exported from the package index, so it was dead code that also stood as an invitation to bypass the switch. v1 keeps its own copy. Every remaining path composes builtins through `visibleBuiltinSkills`. * fix(agent-core-v2): send the configured identity on custom-registry imports `:import_registry` fetched a user-supplied third-party URL with a hardcoded `kimi-code-kap-server` User-Agent, so the first request to a registry announced the product while every scheduled refresh of the same registry announced the configured identity. The hardcoded value was wrong on its own terms too: that token names the server, and this path also runs in the CLI. Both services now project the identity through `identityUserAgent`, which carries the two guards (no host header, or no identity) once instead of per caller. The model catalog keeps an inline copy on purpose — kosong is a foundational layer and must not import an app domain. Sweeping the remaining outbound User-Agent sources found no further gaps: WebFetch deliberately sends a Chrome-like UA, the models.dev catalog fetch sends none from the CLI, and kap-server's `user-agent` reads are inbound. * docs: scope the identity env vars and condense the changeset The environment-variable reference advertised all three new variables without noting that only the agent-core-v2 engine reads them; the configuration page already carried that note. Added in both locales. The changeset had grown into two paragraphs of implementation detail, which is what would land in the CLI release changelog. `gen-changesets` asks for one short sentence plus at most a one-line usage hint. * docs(agent-core-v2): describe the identity as what the agent calls itself The module headers had drifted into describing the feature by what it keeps off the wire rather than what it configures. Reworded so they state the capability: the identity is the name the agent uses for itself, and the unset case is a no-op rather than something "safe". The product-skill switch excludes skills rather than hiding them. Wording only; behavior and structure unchanged. * test(agent-core-v2): cover the identity on custom-registry imports The import path switched from a hardcoded `kimi-code-kap-server` token to the host User-Agent projected through the identity, but nothing asserted it. Two cases pin both halves: a configured identity reaches the request, and an unconfigured one leaves the host header intact — the second matters because a single case would also pass if one hardcoded value had simply replaced another. Both fail against the previous implementation. * fix(node-sdk): guard every global MCP OAuth path behind config readiness `McpOAuthService` caches providers by store key and stamps the client name when it first builds one, so any path that can materialize a provider has to run after config has loaded. `beginGlobalMcpServerAuth` awaited readiness, but `resetGlobalMcpServerAuth` reaches the same cache through `invalidate()` -> `getProvider()` without waiting: resetting auth right after the harness is constructed pinned the built-in client name, and the await added to the begin path could not help because it then reused that cached provider. Rather than add the missing await, the accessor is now async and holds the guard itself, so the service cannot be obtained before config is ready and a future entry point cannot forget. The remaining `configReady` in `testGlobalMcpServer` stays — that one is for its own `[mcp]` section read. * fix(agent-core-v2): send the configured identity on models.dev requests The directory fetch behind `listModelsDevProviders` / `getModelsDevProvider` still hardcoded a `kimi-code-kap-server` User-Agent, so browsing or importing from models.dev announced the built-in product — and claimed to be the server even when running in the CLI. Only the custom-registry import had been fixed. `getModelsDevCatalog` now takes the User-Agent from its caller: the module is plain module-level state with no container access, and the value depends on the host and the configured identity, which only the calling service can see. All four third-party fetches in that service share one helper. Where the host states no User-Agent, a neutral token stands in rather than dropping the header — these are directories the service chooses to call, so there is no host intent to preserve, unlike the provider requests the model catalog assembles. Both new tests fail against the previous hardcoded value. * test(agent-core-v2): assert the product-skill set literally The expected sets were derived from the same `productSpecific` field the production filter reads, so a builtin silently losing its marker would just move between sets and leave every assertion green — while staying visible to the model once the switch is off. The five names are now literal, with a test asserting the marked set matches them exactly. Dropping the marker from one skill now fails four tests instead of none. Also states the App scope in the identity contract header, per the domain's comment convention for contract files. * fix(agent-core-v2): normalize the host-declared display name too Blank and padded values were normalized on the config side but not on the host fallback, so an embedding host passing `displayName: " "` rendered "You are ," into the system prompt, and a padded name kept its padding. Same rule now applies to every source of the name. Also names `agentIdentity` as the collaborator in the request-headers adapter header, which described the value it obtains without saying which domain resolves it. The three new cases fail against the previous implementation. * fix(agent-core-v2): keep the configured slug when the host sends no User-Agent The neutral fallback added for hosts that state no `User-Agent` discarded a configured identity along with it: `identityUserAgent` returns `undefined` as soon as there is no host header to rewrite, so `?? DEFAULT_IDENTITY_SLUG` sent the literal `agent` even when `[identity].slug` was set — precisely the case that fallback exists to serve. The configured slug now stands on its own, with the neutral token reserved for having neither. The four combinations of (host header, configured slug) had three tests; the missing one is the one that was wrong. It now fails without this change. `outboundUserAgent` also awaits config readiness before reading the identity, so a browse issued right after bootstrap cannot send the pre-load value — the guard lives in the accessor rather than at its four call sites, matching how the same race is handled elsewhere in this branch. Both headers here and in `discoveryService` now name `agentIdentity` as the collaborator resolving that token. * test(acp-server): follow the renamed skill-activation tag `acp-server` arrived on main after the tag rename, so its two assertions still expected `kimi-skill-loaded` and failed once the branches met. Also updates the web app's CSS comment, which named the old tag from the start of this branch — a comment, so nothing ever failed on it. Found by CI: the merge verification only ran agent-core-v2's suite, and this package is neither a dependency nor a dependent of it. * fix(agent-core-v2): present the configured slug on registry refreshes too The previous round taught the import path to fall back to the configured slug when the host states no `User-Agent`, but left the scheduled refresh of the same registry on the bare projection — so one registry could see `acme` on import and the runtime default on refresh. Extracting `identityUserAgent` had made the two paths share a function without sharing the policy. The choice itself is now the shared piece: `identityUserAgentOrDefault` always yields a value, for the directories this process chooses to call, while `identityUserAgent` stays the form that rewrites only what the host already sends — what a provider request needs, where the host's silence is its own choice. * docs(agent-core-v2): move new member docs into the module headers The domain's comment convention is absolute — comments live solely in the top-of-file block — and I had read the "functions, methods, or statements" clause as leaving interface members out. It does not: only 25 of 734 v2 sources carry an indented block, so the members I documented were the exception, not the pattern. Seven members across six files move into their headers. `types.ts` had no header at all, so it gains one. * fix(agent-core-v2): connect session MCP overlays after config is ready The shared manager reaches `connectAll` through `initialize()`, which awaits the config domain first; `sessionOverlay` called it straight away. A session carrying ephemeral `mcpServers` created right after bootstrap therefore resolved the client name before config had loaded and initialized under the built-in one. The blast radius is wider than that one connection: a remote server sends the overlay through `hasTokens()`, which materializes an OAuth provider on the *shared* service and caches it by store key — so the early name outlives the connection that raced. The overlay now connects behind `mcpConfig.ready`, leaving the returned readiness promise unchanged. * fix(agent-core-v2): reload builtin skills when their switch changes The workspace catalog keeps each source's contribution for the life of the handler, so a `builtin_product_skills` toggle never reached an existing handler's sessions. That was harmless while every surface read the same constant — but routing the session-less listings through the config made the two views disagree, since those read the switch on every call. Follows `ExtraFileSkillSource`: subscribe to the owning section and fire `onDidChange`, which the catalog already turns into a source reload. The test asserts an unrelated section does not trigger it. * fix(agent-core-v2): apply the identity to self-configured web services `[services.moonshot_search]` and `[services.moonshot_fetch]` name their own `base_url`, so both services can point at an endpoint the user chose — but each forwarded the host request headers verbatim, sending the built-in product token there under a configured identity. Only the services-config path is rewritten; the managed OAuth path keeps the host headers as they are, being the endpoint the session authenticated against. The distinction is the same one the model catalog draws per vendor. `identityHeaders` carries the rewrite across a whole header set, so this is the fourth caller sharing the projection rather than repeating its guards. A pair of tests pins both halves. My earlier sweep classified these two as official by their names instead of asking who chooses the URL, which is why they were missed. The contract header is also condensed here, per the convention below. * docs(agent-core-v2): condense the identity headers to their contracts The comment convention is one sentence with two halves — comments live only in the top-of-file block, *and* that block states the module's role without narrating implementation. Moving the member docs up last round satisfied the first and broke the second: the headers ended up spelling out the slug folding algorithm, the strip mechanics, and the load order. Kept what a caller or the next editor would get wrong without it (why the value is read rather than snapshotted, what `undefined` obliges a consumer to do, why this source waits for config). Dropped what the code already says. 22/12/12/13 lines, against 53 in `catalogService.ts` — length was never the problem. * fix(agent-core-v2): rebuild active prompts when the builtin skills change Reloading the catalog on a `builtin_product_skills` toggle left existing agents holding the old listing: `AgentProfileService` refreshes the prompt only for the plugin source, so a disabled switch kept advertising skills that were gone, and enabling it left them missing until an unrelated refresh. The plugin source is special because it also contributes prompt sections (#2314), and the file-backed sources are left out for cost — their fs watches would rebuild every agent's prompt on each edit. The builtin source has no watch: it changes only when its config switch is toggled, so it belongs with the plugin source rather than with the file ones. Subscribing to the catalog rather than the config section is load-bearing. The catalog fires after the contribution is replaced, whereas a config subscription would race the reload, and `resolveSkillListing` only awaits the catalog's *initial* readiness — so the rebuilt prompt could read the listing it was meant to replace. The source id is a named constant now, so the subscription does not match on a bare string. * refactor(agent-core-v2): freeze the agent identity for the process lifetime The identity is announced outward (MCP initialize, OAuth registration, provider request logs) and cannot be re-announced, so mid-process changes could only ever apply partially. Resolve it once when config first loads and hold it for the life of the process: IAgentIdentity now hands out a frozen snapshot via resolved()/current(), carrying finished products (outbound User-Agent variants, rewritten header set) so call sites stop composing host headers with the slug themselves. The kosong host-headers port carries two finished layers and the catalog only picks one; consumers gain no invalidation obligations because the value can never change after the freeze. [identity] edits take effect on the next start (documented). * fix(agent-core-v2): locate the User-Agent header case-insensitively HTTP header names are case-insensitive, but the snapshot builder looked up 'User-Agent' by exact key: an embedding host spelling it 'user-agent' got no third-party UA and kept its own product token on the services path even with an identity configured. The builder now locates every case variant and rewrites each in place, keeping the host's spelling. Also corrects the two web-service headers that still described both paths as sending the bootstrap headers, naming agentIdentity as the collaborator behind the config path, and documents that a resumed session keeps its recorded system prompt. * fix(agent-core-v2): attribute header provenance from the finished third-party layer Inspection reconstructed the non-full host layer from the raw headers with an exact-case 'User-Agent' lookup, so a host spelling the header 'user-agent' got a resolved User-Agent with no provenance entry even though the runtime sends the rewritten value. buildModel now captures the port's finished third-party layer in the trace and attribution reads it, keeping inspect() on the same resolution pass as get(). Also condenses the identity contract header to its external role, and documents that an existing MCP OAuth authorization keeps the client registration it was granted under (reset the server's auth to register under the new identity). * fix(agent-core-v2): keep web tool backends from racing the identity freeze An env-configured [services] endpoint is visible before config finishes loading, and FetchURLTool / WebSearchTool materialized their backends at construction — so a fast bootstrap could hit the identity snapshot's pre-freeze guard during agent creation, and the composed backend pinned config and login state for the agent's lifetime against the service's documented per-call resolution. Both tools now resolve their backend per invocation, the WebSearch activation gate checks presence alone through the new hasWebSearchProvider() (no provider composition, no identity read), and bind() awaits the identity freeze before materializing the model, whose resolution reads the identity through the host-headers port.	2026-08-04 22:35:15 +08:00
Haozhe	119a33f7f1	feat(minidb): persistent index generations and lifecycle hardening (#2604) ... * perf(minidb): skip idle everysec fsyncs and add lifecycle stats - everysec WAL now fsyncs on the timer only while dirty (tracked by a write/sync generation watermark); close() keeps its unconditional final sync, and background sync failures surface via walFsyncErrors plus a sticky lastWalFsyncError instead of being silently swallowed - add WAL queue/group-commit counters (walQueuedBytes, walMaxQueuedBytes, walGroupCommits, walGroupCommitFrames) and lifecycle phase stats: recovery bytes/frames/duration, index/text rebuild durations, compaction total/snapshot/rotation/postings durations, rotation pause, and query candidates/decoded/sorted rows; add a syncIntervalMs open option threaded through compaction WAL rotation - rewrite the bench on fixed-seed synthetic data with a stable machine-readable JSON report (cold open 10k/50k/100k, word/ngram search, idle-fsync acceptance, 100k compaction, event-loop delay, peak heap/RSS per scenario) and pin the schema in test/bench-json.test.ts; add app-side baselines with loose complexity budgets in sessionIndex and searchService tests - fix ClusterDb lock-pool closeAll() leaking in-flight shard opens and drain the query store's async close on server shutdown, eliminating the ENOTEMPTY directory-teardown race * perf(minidb): bound startup rebuild and steady-state hot paths - rebuild all derived indexes in one shared store walk: a single decode per record fans out to staged builders, dt rebuild reads record metadata only, and index-less opens no longer decode at all - rank full-text results with a bounded min-heap plus a stable key tie-break instead of sorting every candidate - remove/overwrite text docs via a docID -> delta-terms reverse map instead of scanning the whole delta vocabulary - validate unique batches incrementally against touched postings instead of copying the full per-index owner map - reap due TTL entries from the expiry heap on the write path instead of a full-store sweep per write * feat(session-index): add minidb read model with keyset pagination - add ISessionIndex read-model lifecycle (prepare/status, ready/degraded states) behind the persistence_minidb_readmodel experimental flag - add ISessionIndexMirror write side recording fresh summaries into a bounded, coalescing queue after the authoritative document is durable - replace the offset cursor with before/after keyset pagination; rename list/countActive to listRecent/count - extend IQueryStore with ordered columns and pageByColumn, plus getMany/listKeys/dropCollection - wire the read model through kap-server routes and start, and update the klient sessions contract - index every session for global search instead of the 500 most recent * feat(kap-server): bound search sync lifecycle, pagination, and query budgets - split search requests from sync work: searchIndex() no longer awaits runSync/reopen/reindex; a single-flight sync coordinator with debounce and backpressure runs in the background, stale generations keep serving with explicit stale/degraded state, and refresh/sync/reindex failures surface via lastRefreshError instead of being swallowed - scope file-meta keys by session id (\0meta\file\<sessionId>\<hash>) with lazy + one-shot background migration from the legacy hash-only keys, so one session sync only touches its own meta rows - make authoritative scans incremental (mtime/ino/size rescan conditions, unchanged files no longer rewrite meta) and read wire deltas in 1 MiB chunks instead of whole-file buffer + split - replace offset pagination with versioned v2 keyset page tokens (fingerprint + index generation + sort boundary); generation changes fail old tokens with invalid_page_token, legacy v1 offset tokens are served once and upgraded, and pages collect via bounded top-K instead of full sort + offset skip - add query budgets enforced at the postings/score stage: max query terms, literal length cap, postings visit budget (minidb searchBounded/maxVisits with prefix decoding that never fabricates hits and skips the postings LRU), candidate caps, deadline and text budget; truncation is reported via incomplete reasons candidate_cap/postings_budget/deadline - reopen read-only dbs by opening the next handle before closing the previous one so a failed refresh keeps the old generation serving; failed opens now self-heal through search traffic 100k-message bench: first page p95 < 300ms and page-100 cost on par with page 1; event-loop delay during queries stays sub-millisecond. * fix(minidb): poison, roll back, and recover the WAL on write failures - give WAL writes a commit point: a failed flushBatch poisons the WAL (WAL_POISONED, tracked separately as walWriteErrors vs walFsyncErrors), rejects queued frames in reverse enqueue order, and stops scheduling further batches; everysec background sync failures stay non-rejecting per stage-1 semantics - recover in place to a known-safe point: a serialized recovery chain truncates the WAL back to the first un-acked frame, rebuilds size/nextOffset, and clears the poison; writes queue behind the recovery gate (zero-cost when idle), a failed truncate flips the instance into an explicit writeDisabled state, and a stale truncate offset (WAL file replaced by a rotation) skips the truncate - roll failed flush groups back as a unit: frames are stamped with their batchId, MiniDb keeps per-group earliest pre-state, and the first rejection restores every key of the group (rejected writes no longer reappear after reopen, and in-memory state matches reopen for any failure interleaving); the per-op seq guard remains for cross-group and rotation-retry races - wrap applyOp and the following in-memory mutations so a contract violation poisons the WAL and rolls the group back instead of escaping as a half-commit; frames never enqueued (seal race) roll back per-op without poisoning - tag errors past the commit point with ambiguous: true so callers can distinguish "definitely not applied" from "maybe applied but revoked" - close() waits for the recovery chain to go idle and backup() fences behind in-flight recovery before copying files Controlled A/B bench (22 alternating iterations, 100k concurrent sets): write-path throughput regression is within the 2% budget. * fix(minidb): turn the file lock into an instance-owned serialized lease - distinguish lock ownership by instance instead of pid: every acquire mints a pid:uuid token carried by lock/bid/watch files, inspect().mine compares tokens, liveness still follows pid, tokenless legacy files keep the old stale-takeover path, and hasLiveForeignWatch excludes self by token so same-process contenders see each other (closing the double-win takeover and the cross-instance release); a live same-pid lock is still respected, and re-acquiring a held lock is idempotent - serialize acquire/renew/release through a per-instance promise-chain mutex: renew re-checks held inside the chain and release waits for an in-flight renew, eliminating the renew/rename-after-unlink ghost lock - make MiniDb.close() a state machine (open/closing/closed) with a shared closePromise: cleanup runs per-resource try/catch in dependency order (text indexes, store, valueReader, WAL, lock), aggregates every cleanup error into an AggregateError, stays in 'closing' on failure so a retry finishes the cleanup, and no longer leaks the lock when the WAL close fails; a rejected in-flight compaction no longer escapes the cleanup pass * fix(minidb): keep readers on one consistent file generation - add an internal persistent-files module as the single source of truth for the persisted file set (snapshot, WAL, sidecars, postings pattern, fingerprint subset); lock-pool fingerprints, persistentFiles, open stale-tmp cleanup, and backup/restore filtering all derive from it, and fingerprints upgrade to dev:ino:size:mtimeMs so compound sidecar changes can no longer hide from cluster readers - pair snapshot and WAL generations during recovery (transitional stat-pairing until stage-5 manifests): each pass anchors the fds it scans, re-stats afterwards, tolerates append-only WAL growth, retries bounded times on generation churn with a clean store reset, and throws RECOVERY_GENERATION_CHURN when churn exceeds the budget; the disk-mode ValueReader attach re-validates inodes so stale offsets never read a replaced file - make the rotation directory fsyncs strict: failures abort the rotation through the existing rollback path instead of being swallowed, while platforms without directory fsync degrade once with a warn and stats.dirFsyncUnsupported * fix(minidb): serialize index-definition sidecar mutations, persist before publish - extract the promise-chain mutex into a shared createSerializer() and give each sidecar family (secondary/compound/text) its own chain: create/drop run uninterruptibly (memory change + rebuild + persist), different families stay independent, and the data write path never shares these chains - reverse the publication order to staged -> persist -> publish: a create stages the definition, rebuilds via the staged builder, persists the sidecar including the new definition, then publishes atomically; any failure discards the staged state leaving live and sidecar untouched (no phantom indexes, retry-safe); a drop persists the sidecar without the definition before removing it live; text index create/drop adopt the same pattern, replacing the hand-rolled unwind, and a dropping marker keeps compaction postings rebuilds out of the persist window - feed staged indexes from the incremental write path (add/remove/ checkUnique/checkUniqueBatch visit live+staged) so writes landing in the persist window are not lost at publish; queries still see live only - harden writeFileAtomic: instance-unique tmp names (.tmp-pid-seq), a strict fsyncDir after rename so a successful persist is crash durable, and whitelist-based stale-tmp cleanup that never touches lock tmp files * fix(minidb): validate writes before any side effect, canonicalize values once - canonical value at the write boundary: the json codec re-parses the encoded bytes once and every downstream consumer (unique checks, secondary/compound/text indexes, dt extraction) sees exactly the persisted representation, so getter/toJSON/Proxy documents can no longer diverge between the index view and the storage view - reorder the set/batch pipeline so every fallible check happens before any visible side effect: prepare (key/ttl checks, encoding, canonical decode, index field extraction, tokenization) -> unique checks -> ensureMemoryFor eviction -> commit; a constraint failure now leaves the database untouched (no more evicted victims on rejected inserts), and applyOp is structurally pure against pre-validated data - tokenize at the prepare boundary: TextIndex gains prepareAdd/ addPrepared and the buildQueue carries validated key+tokens mutations instead of raw docs, so a throwing custom tokenizer can no longer poison the live view or the queue, and custom-tokenizer output is rejected per token over 0xffff bytes before it can permanently break postings rebuilds; prepared tokens are keyed by index instance so a same-name drop+create mid-write re-tokenizes instead of crossing tokenizers - strict batch structure validation: scanBatchOpRefs/decodeBatchOps reject unknown op types, out-of-bounds lengths, and trailing bytes (offset must equal body length), so a valid-CRC but malformed batch is skipped as a unit and counted via RecoveryInfo.corruptBatches instead of being partially applied Bench vs the stage-1 baseline: json write throughput regression is within the 5% budget (median ~2-4% depending on the measurement). * feat(minidb): add OpTracker drain primitive and atomic backup, harden tests - introduce the internal OpTracker (close gate + in-flight counter with enter/leave/close/whenIdle and reference-counted pause/resume) and drive every shutdown/drain path from it: WAL background syncs are tracked so close() waits out an in-flight sync before closing the fd, cluster lock-pool closeAll() closes the gates and drains busy callbacks before closing handles, and MiniDb writes pass a write gate - make backup() atomic with a defined linearization point: pause the write gate, drain in-flight writes (every acknowledged write is now included), copy to a sibling temp dir with per-file fsyncs, write the manifest last as the commit marker, and rename into place; failures clean up and leave no partial backup, and concurrent writes are rejected with BACKUP_IN_PROGRESS - reap emptied compound-index groups on remove (the groups map no longer grows monotonically), move the open-time mkdir behind the readOnly check so a read-only open of a missing directory fails with ENOENT instead of creating it, and never run a destructive rebuild for a read-only open failure (explicit or onLockFail fallback) - consolidate every review fault-injection repro into the formal suite behind deterministic barrier helpers (programmable writev/sync/ rename/tokenize hooks) and convert the six timing-based tests to barrier/tick-driven assertions; the .tmp repro scripts are removed The converted timing tests and the full suite pass 50 repeat runs (including under CPU load injection) with zero flakes. * feat(minidb): persist derived indexes as atomic generations, open from WAL delta - checkpoint the store, dt/secondary/compound indexes, and text dictionary/postings/docs into immutable generations under generations/g-NNNNNN published atomically (tmp build, per-file checksums and fsyncs, dir rename, CURRENT swap, strict dir fsyncs); the manifest records the format version, WAL/snapshot checkpoint anchors, per-index definition hashes, and codec/value-mode compatibility - open now loads the published generation and replays only the WAL delta after its checkpoint: no full value decode, corpus tokenization, or postings rewrite on a normal reopen (warm opens are 3.5-13.8x faster at 100k/1M records); a definition change rebuilds only the affected index, and corrupt generation files fall back to the previous generation or the legacy full recovery without ever touching the authoritative snapshot/WAL - build generations transactionally with compaction (rotation plus derived state publish as one unit, replacing the synchronous rebuildTextPostings tail), capture concurrent writes through a sealed op queue with byte/op caps, hard-link clean postings and the snapshot into the new generation, and repoint every live text base into the CURRENT generation after publish - cluster/read-only refresh watches CURRENT and the WAL watermark: pure generation publishes keep readers on incremental catch-up while rotations reopen onto the new generation; writers building the next generation never disturb readers of the current one - legacy databases open through the old path unchanged and gain their first generation in the background; OpenOptions.indexGenerations: false fully restores the pre-generation behavior * feat(minidb): workerize text-index builds and split MiniDb into facets - split the monolithic src/index.ts into facet modules (mini-db, types, value-codec, memory-guard, backup, query-engine, text-registry, wal-group, generation-builder/loader, write-path, read-path, index-admin, lifecycle, stats) and move text-index.ts to text-index/ - run corpus-scale text-index builds off the main thread via the bounded worker engine (src/worker/), exported through the new worker-runtime subpath, with inline fallback for small corpora and rollback switches - defer the open-time fallback text rebuild into a maintenance task; searches on a not-yet-committed base raise TextIndexBuildingError - add the unified maintenance scheduler, bounded async read surface, and a maintenance bench - kap-server search: switch to searchBoundedAsync and serve the building page while the index base rebuilds after fallback recovery - kimi-code: install the SEA-bundled minidb text-build worker at startup, bundle it via the native asset scripts, and add the startup-trace util plus the KIMI_TUI_INPUT_LATENCY debug probe * fix(minidb): treat win32 EPERM as unsupported directory fsync - extract isUnsupportedDirectoryFsyncError and cover win32 EPERM - drop the one-shot console.warn; stats.dirFsyncUnsupported carries the degraded state * fix(kap-server): harden search-index dispose and drain lifecycle - dispose() now closes an OpTracker gate and drains in-flight sync/refresh passes before closing the db, so no background write can hit a closed handle; the deleteSessionDocs loop and trailing stats write skip once the gate closes (review #20) - drainGlobalSearchDisposals loops to a fixpoint so disposals registered while a drain is in flight are also awaited (review #21) - pin the post-open failure semantics with a regression test: a failed text-index setup closes the handle and the next open reacquires the writer lock instead of self-locking read-only (review #19) - export OpTracker from the minidb root for the search service's drain * chore: fix oxlint type-aware lint errors	2026-08-04 20:38:42 +08:00
zy	74c321e4c6	fix(mcp): drop protocol-reserved _meta keys from model-visible output (#2600) ... * fix(mcp): drop protocol-reserved _meta keys from model-visible output Follow-up to #2596. The MCP spec reserves _meta key prefixes whose labels include "modelcontextprotocol" or "mcp" for protocol use; those entries carry host/protocol plumbing rather than model-facing data, so filter them out before serializing the <mcp-structured-result> block. Unprefixed and vendor-prefixed keys still pass through — their semantics belong to the server. Also moves the v2 implementation commentary into the module header per the agent-core-v2 comment convention. * fix(mcp): reserve _meta prefixes only when a label follows mcp/modelcontextprotocol Per the spec's key-name rules a prefix is reserved when a modelcontextprotocol or mcp label is followed by at least one more label; a trailing reserved word (com.example.mcp/) is a legitimate vendor namespace and now passes through. --------- Co-authored-by: zouying <zouying@moonshot.cn>	2026-08-04 20:03:10 +08:00
zy	96f77fe392	fix(agent-core-v2): port the MCP auth:'oauth' opt-in from v1 (#2608) ... v1 lets a remote MCP server combine static headers with OAuth via the auth:'oauth' config marker; v2 neither parsed the field nor honored it, so any configured headers were treated as static credentials — first authorization never started and an expired refresh token left the entry permanently failed. Add the field to the v2 remote config schemas and mirror the v1 guard in shouldMarkNeedsAuth. Resolve #2605 Co-authored-by: zouying <zouying@moonshot.cn>	2026-08-04 20:02:57 +08:00
zy	3126422757	feat(mcp): carry an absolute expiresAt on the OAuth authorization-url update (#2609) ... * feat(mcp): carry an absolute expiresAt on the OAuth authorization-url update The authenticate flow waits for the OAuth callback with a fixed budget, but the authorization-url tool update surfaced to embedding hosts did not say when that window ends — hosts had to hardcode a mirror of the 15-minute constant to render countdowns. Include the absolute deadline (now + effective wait timeout) in the update payload for v1 and v2. Resolve #2607 * fix(protocol,kap-server): accept expiresAt in the OAuth authorization-url update schemas The zod validators mirrored the pre-expiresAt payload shape and would strip the new field at the kap-server boundary. --------- Co-authored-by: zouying <zouying@moonshot.cn>	2026-08-04 20:02:47 +08:00
7Sageer	aec755fad6	feat(agent-core-v2): announce date changes via a system reminder (#2564) ... * feat(agent-core-v2): announce date changes via a system reminder * refactor(agent-core-v2): hide profile rendering behind service * refactor(agent-core-v2): normalize profile prompt rendering at registration * chore: retrigger ci	2026-08-04 19:31:00 +08:00
zy	c32e661faa	fix(mcp): pass structuredContent and _meta through to model-visible tool output (#2596) ... MCP tool results were narrowed to {content, isError}, dropping the spec-defined structuredContent field and _meta metadata. Servers that return structured contracts in these fields (validated against outputSchema, or namespaced metadata such as browser-handoff payloads) were invisible to the agent. Surface them as a serialized <mcp-structured-result> block appended to the tool output, still subject to the existing text budget. Co-authored-by: zouying <zouying@moonshot.cn>	2026-08-04 18:01:42 +08:00
qer	0abcd00f7f	feat(cli): add built-in Computer Use and WebBridge capabilities (#2407) ... * feat(agent-core-v2): add built-in capabilities (kimi-cu, kimi-webbridge) with REST routes Add a capability domain holding a closed registry of built-in product capabilities. Each entry owns layered readiness detection and idempotent install orchestration: binary runtimes from fixed official CDN URLs (KimiCU.app + launchd service + TCC permission state; the WebBridge daemon with start-if-down semantics for Kimi Work coexistence) plus agent wiring through the plugin service. The WebBridge wiring un-shadows stale user-source skill copies (user priority beats plugin priority). kap-server exposes the domain as GET /api/v1/capabilities, GET /api/v1/capabilities/{id}, and POST /api/v1/capabilities/{id}:install with client-polled progress and new wire codes 40418 / 40922 / 40923. The plugin marketplace gains an official kimi-webbridge entry (browser-control skills) packaged by the existing CDN build. * fix(agent-core-v2): rename the webbridge wiring plugin to kimi-webbridge-skill An official kimi-webbridge guide plugin (install/remove setup skills, v3.0.4) already exists at the marketplace path the capability installer pointed at — a different artifact owned by another release line. Give the browser-control usage-skill plugin its own id/path instead of colliding with (or overwriting) the guide plugin. The capability entry's detect/install now tracks kimi-webbridge-skill; a machine with only the guide plugin correctly reports the skill layer as missing. * feat(agent-core-v2): shelf installs auto-complete capability binary layers Two changes to make the plugin marketplace a first-class install path: - Marketplace gains kimi-cu (sourced from the CU team's CDN zip — no repackaging) and the kimi-webbridge usage-skill plugin now claims the kimi-webbridge id at v4.0.0, deliberately superseding the WebBridge guide plugin (v3.0.4, install/remove guide skills): guide users get a version upgrade onto the real usage skill. - The capability service subscribes to IPluginService.onDidReload: when a capability's wiring step flips to ok through ANY install path (shelf, TUI, CLI), it auto-completes the missing binary layers (KimiCU.app + service, or the WebBridge daemon). Triggers only on the false→true edge so completed installs with still-missing manual steps (TCC permissions) never retrigger heavy downloads on later reloads. * fix(plugins): keep kimi-webbridge plugin version aligned with the upstream skill The plugin version tracks the bundled official usage skill (1.11.3) so version drift against the WebBridge release line stays visible, instead of minting an independent 4.0.0. * fix(agent-core-v2): never report the webbridge installer-script version as the product version The on-disk ~/.kimi-webbridge/bin/kimi-webbridge.version file tracks the installer's own lineage (3.1.x, bumps on every install/upgrade run), not the product version (v1.11.3 — daemon, extension, and skills all share it). A downed daemon would have shown the misleading installer number; report no version instead (live /status remains the source of truth). * chore(plugins): list kimi-cu on the marketplace without a pinned version Marketplace versions are optional by schema: rows display the version detected from the installed plugin's manifest, and update prompts only fire on a valid semver latest > local comparison. A hand-maintained number would drift just like the guide plugin's did. The locally built kimi-webbridge entry keeps its manifest-stamped version (1.11.3). * fix(agent-core-v2): fire onDidReload on plugin mutations, not just explicit reload installPlugin / setPluginEnabled / removePlugin changed the catalog silently — consumers listening to onDidReload (session skill-catalog convergence, the capability shelf-install hook) only converged on an explicit reloadPlugins(). Fire the same summary-shaped event on every mutation (added:[id] / [] / removed:[id]) so every install path converges. This also unbreaks the shelf-install hook on real hosts: its unit tests passed against a fake emitter that fired on installs, which the real service never did. * feat(kap-server): add plugin management and marketplace REST routes Expose the App-scope plugin service over the wire so non-CLI hosts (desktop, web) can manage plugins end to end: - GET /api/v1/plugins/marketplace — catalog (pluginMarketplaceUrl server option / KIMI_CODE_PLUGIN_MARKETPLACE_URL env / production default) merged on demand with live install state; updateAvailable only on strict semver catalog > installed (no semver dependency) - GET /api/v1/plugins, POST /api/v1/plugins {source} - POST /api/v1/plugins/{id}:{enable,disable,remove} - New wire code 40419 plugin.not_found Mutations flow through IPluginService, so they serialize with other install paths and fire onDidReload (session skill catalogs and the capability shelf-install hook converge). * feat(agent-core-v2): surface a machine-key note from capability installs CapabilityEntry.install now resolves an optional note exposed through CapabilityInstallProgress.note (wire-visible). The webbridge entry returns 'user-skill-migrated' when it replaces a pre-existing user-source skill (from the official installer) with the plugin-managed copy — clients can localize the migration instead of the skill silently disappearing from the user's directory. * feat(tui): let the real WebBridge marketplace entry win over the pinned promo The hardcoded Web Bridge row was built when WebBridge had no plugin package — it pinned above the Official tab and shadowed any catalog entry with the same id (open-in-browser only). Now that the marketplace carries the real kimi-webbridge plugin, flip the precedence: the catalog entry renders and installs normally, and the pinned promo becomes a loading/error/legacy-catalog fallback only. Footer counts keep their old semantics (catalog-only; the promo row is never counted). * fix(tui): dim the installed state so it stops reading as the install action Both badges shared a near-identical green-ish treatment in the same column, making a quiet fact look like a clickable action. States now recede (installed → textDim) while actions stay loud (install → primary, update → warning). * feat(agent-core-v2): converge plugin state across processes sharing a home Multiple hosts share one KIMI_CODE_HOME (CLI, desktop, other agents), but each PluginService kept a private in-memory snapshot: a plugin installed or removed in one process stayed invisible to every other live process until its next restart — new sessions there kept offering stale plugin skills/MCP, and the capability shelf hook never saw peer installs. Watch <home>/plugins for installed.json changes and reloadPlugins (debounced, echo-suppressed around our own mutations) so all consumers converge in well under a second: session skill catalogs, plugin MCP mounts, and the capability shelf-install hook alike. * fix(agent-core-v2): un-shadow webbridge user skills in BOTH user dirs kimi-code resolves user-scope skills from two roots (~/.kimi-code/skills and ~/.agents/skills), both at priority 20 — a stale copy in either shadows the plugin-managed wiring (priority 5), and also keeps the capability working after the plugin is removed, which reads as 'uninstall did nothing'. Migrate copies in both dirs during install; other runtimes' dirs (~/.claude, ~/.codex) remain untouched. * feat(tui): show live runtime-setup progress for capability installs Installing a capability plugin (kimi-cu, kimi-webbridge) from the /plugins shelf kicked off a silent background binary install — the row flipped to installed while megabytes of runtime downloaded invisibly. Route capability entries through the capability surface instead: the panel's inline installing line now mirrors live progress (step + percent) until the install settles, and the transcript reports ready / failure-with-retry / still-running accordingly. Capability removal prints an explicit note that runtime binaries are deliberately left untouched (the capability keeps working), since that read as 'uninstall did nothing'. Plumbs the capability service through klient's global facade ('capabilityService' decorator resolves in-process) and the node-sdk v2 client; Session exposes it with a structural feature-detect so v1 engines fail clearly. * docs(plugins): keep the kimi-cu marketplace blurb accurate for every client Only the capability-aware clients auto-install the KimiCU.app runtime; older builds still get wiring-only (the wrapper's error message then points at the official setup script). Don't overpromise in the catalog text every version reads. * feat(agent-core-v2): install capability wiring from client-bundled plugin copies The kimi-cu / kimi-webbridge wiring plugins ship inside the client release instead of the marketplace catalog, binding their visibility to the client version. Capability installs now resolve the bundled copy (env override, then npm-layout and source-checkout probes from the module) and install it as a local path, replacing the two CDN zip URLs. A missing bundle fails the wiring step with a clear reinstall-or-upgrade message. * build(cli): bundle the capability wiring plugins into client releases Vendor the official kimi-cu plugin (v0.5.4, from the CU team's plugin zip) next to kimi-webbridge under plugins/official, copy both into apps/kimi-code/bundled-plugins at build time, and ship them in the npm package (files) and the native SEA blob (a new bundled-plugins asset set extracted into the native cache at startup, published to the engine via KIMI_CODE_BUNDLED_PLUGINS_DIR). Desktop points the same variable at its extraResources copy. The .gitignore build-output entries are anchored so sources under src/native and test/native stop being silently ignored. * revert(plugins): remove the kimi-cu and kimi-webbridge marketplace entries Both capabilities now distribute with the client (bundled wiring), so the catalog drops back to kimi-datasource / superpowers / vercel-plugin. Older clients never see the entries; current clients install from the Built-in section. This also reverts the marketplace blurb commit 0635e99c5. * feat(tui): add a Built-in capabilities section to the plugins panel The Official tab now opens with a Built-in section fed by the engine's capability registry (kimi-cu / kimi-webbridge): per-row install state (install / finish setup / ready), Enter runs the full capability install with live progress, and unsupported rows hide (kimi-cu off macOS). The WebBridge promo fallback only remains for v1 engines — on v2 the real built-in entry wins. Rows double as the reinstall path: a client upgrade ships newer wiring, and installing again upserts from the new bundle. * docs(plugins): document the Built-in section and refresh the capability changeset * build(nix): stage bundled capability plugins into the SEA build The native SEA blob now embeds the bundled-plugins asset set, so the nix derivation needs the plugins tree in its src fileset and the staging step alongside copy-web-assets before build:native:sea. * revert: drop the client-bundled wiring distribution Built-in visibility is simpler to get by injecting the two capability entries into the marketplace catalog at load time; the wiring plugins themselves keep installing from their fixed official CDN zips. Removes the vendored kimi-cu plugin, the bundled-plugins npm/SEA packaging and flake staging, the engine bundle resolver, and the plugins panel's Built-in section. Keeps the /agents/ and /native/ gitignore anchors so sources under src/native and test/native are not silently ignored. * feat(cli): inject the built-in capability entries into the marketplace catalog The kimi-cu / kimi-webbridge entries are appended by the client at catalog load time instead of being served by the remote marketplace.json, binding their visibility to the client version (older clients never see them). No version is pinned — reinstalling upserts the wiring — and ids the catalog already carries always win. In a source checkout the webbridge entry installs the repo's own plugin copy; packaged builds use the official CDN zip. This reverts the docs paragraph about the Built-in section, which the simpler approach makes unnecessary. * test(tui): select the catalog's own first row in marketplace install tests The client-injected capability entries suppress the WebBridge promo and append after the catalog rows, so Kimi Datasource now leads the Official tab — the extra down-key landed on kimi-cu instead. * feat(cli): surface the built-in capabilities as client-injected marketplace entries The kimi-cu / kimi-webbridge entries are injected into the marketplace catalog by the client (v2 engine, default catalog only) instead of being served remotely, binding their visibility to the client version; injected rows mask same-id catalog rows, so what these ids mean stays decided by the client release — a future official listing only reaches older clients, whose fix is to upgrade. The /plugins panel shows capability readiness on the rows (setup incomplete / installing…), platform-gates kimi-cu to macOS, and Enter finishes the runtime setup with live progress; v1 keeps the plain plugin install path and the WebBridge promo fallback. Capability and plugin calls move from the ad-hoc REST routes onto the typed klient contract (capabilityService next to pluginService), so the public REST surface returns to its pre-feature shape. Detection is presence-only — version pins removed: the current version is always read live (Info.plist, daemon status, install records), installs are detect-first and idempotent so an interrupted setup can be retried, and reinstalling pulls the latest managed artifacts (the passive upgrade path). * ci: retrigger checks * fix(cli): recognize Computer Use CDN plugins as official * fix(cli): keep built-in entries on catalog outage and isolate detector failures Two review follow-ups: the client-injected entries no longer disappear when the marketplace catalog is unreachable (they are not served by it), and a single capability's failing detect probe degrades to a failed step on that entry instead of rejecting the whole listCapabilities call. * refactor(cli): simplify built-in capability integration * refactor(cli): source built-in catalog rows from the engine and tighten detect probes The injected marketplace entries are now derived from the engine's capability registry (listCapabilities) instead of hardcoded client-side copies — the util only owns the mask/append mechanics, and capability ids are no longer pinned in the CLI (the remove note resolves them through the registry too). kimi-cu's detect-path probes (service-status, xpc-ping) get a 3s timeout — they answer in milliseconds when healthy but run on every status listing, so a wedged binary must degrade quickly instead of stalling the panel. Document the Official tab's built-in capability rows in the plugins guide. * fix(cli): answer capability id membership without running detectors listCapabilities() runs every entry's detect probes (seconds on a wedged binary), so using it to decide whether to print the post-remove hint made every plugin removal pay a full detection round. The id set is part of the client/engine contract (mirrored in the klient schema), not product data that drifts — restore the closed-set check. The injected catalog rows keep flowing from the registry. * fix(agent-core-v2): make capability setup recover from disabled, partial, and wedged states Three review follow-ups on the install path: setup now re-enables the wiring plugin when a previous disable survived installPlugin's upsert (detection requires enabled, so it would otherwise strand the capability at partial); the webbridge daemon-binary step verifies the executable bit on POSIX, so an install interrupted between rename and chmod re-downloads instead of failing start with EACCES; and kimi-cu's detect degrades wedged CLI probes (service-status, xpc-ping) to failed steps instead of throwing, keeping the detect-first install able to repair the remaining layers — with the probe timeout injectable for tests. * fix(agent-core-v2): abort capability downloads whose byte stream stalls downloadToFile had no inactivity deadline: a CDN connection that stops producing bytes hung the background install forever, wedging the capability in a permanent installing state (retries rejected as in-progress) until the process restarted. An idle watchdog now fails the download after 30s without a chunk; slow but flowing downloads are unaffected. * fix(tui): stop offering capability setup on unsupported platforms An installed wiring plugin whose capability is unsupported on this OS/arch (kimi-cu off macOS, webbridge on an unknown arch) was treated like a partial setup: the Installed tab showed setup incomplete and Enter routed to installCapability, which the service always rejects. Setup actions are now gated to actionable states (not_installed / partial); unsupported renders as a dim fact and Enter opens details. * fix(agent-core-v2): cover the two remaining install wedge modes Review follow-ups: the KimiCU app step now requires an executable binary, so a ditto interrupted mid-copy reads as missing and the next setup re-copies instead of failing EACCES forever; and downloadToFile's idle budget now also covers the response-header phase via an AbortSignal on the fetch itself, so a connection that never completes headers fails the install (clearing the running state) instead of hanging it. * fix(tui): render capability rows independently of the catalog fetch While the marketplace catalog was loading or unreachable, the Official tab showed only the pinned WebBridge promo — built-in runtime setup was blocked by an unrelated remote fetch, and Enter opened the browser instead of installing. Locally-known capability rows (from the engine registry) now render and install in every catalog state; the promo remains only as the v1 fallback. * fix(agent-core-v2): keep KimiCU cleanup timeouts best-effort stopOldProcesses is documented as || true, but runCommand propagates timeouts: a wedged old binary made kimi-cu uninstall exceed the command timeout and the reinstall died before ditto could replace the app. Cleanup commands now swallow failures (the timeout already attempts a kill) so the replacement always proceeds; the command timeout is injectable for tests alongside the probe timeout. * fix(cli): inject built-in entries only for the default marketplace catalog Injection is part of the default catalog experience: any explicit replacement (slash-command source or KIMI_CODE_PLUGIN_MARKETPLACE_URL) now opts out wholesale — its same-id rows are never masked by the built-ins, and an unreachable custom catalog surfaces its own failure instead of being silently replaced by a built-in-only tab. * refactor: align capability row rendering on the source marker and drop conditional spreads Marketplace-row capability enrichment (status, badges, issue details, platform filtering) now keys on the capability:<id> source marker — the same condition Enter uses to route installs — so a custom catalog row that merely reuses a built-in id renders and installs as a plain plugin. Also replaces the conditional-spread optional fields with direct undefined-valued assignments per the repo coding rules. * refactor(agent-core-v2): move capability comments to the file headers The domain's comment convention allows only the top-of-file block: responsibility and scope context for the recent hardening (detect-first idempotent install, executability gates, probe-failure degradation, best-effort cleanup, download watchdog, per-entry detection isolation) now lives in the module headers, and inline narration beside statements and members is removed. * fix(tui): follow an in-progress capability install instead of restarting it Opening /plugins while a capability setup is already running showed the installing… row, but Enter called installCapability again and the service's duplicate-start rejection (40922) surfaced as a fake failure. The panel now checks the live status first and, when an install is already running, skips the start call and just polls for the existing progress. * fix: align two more replacement paths with their contracts The EXDEV daemon-binary fallback now stages on the target filesystem and atomically renames over the destination instead of opening a possibly-running binary for write (ETXTBSY on Linux). And the panel's fallback capability rows (catalog loading/error) now follow the same default-catalog condition as the loader injection, so an explicitly overridden marketplace fully replaces the Official tab. * fix(tui): make the built-in row marker unforgeable The capability:<id> source string was the trust signal for routing rows into capability installs, but any catalog can write that string — a custom marketplace could smuggle a row past the third-party trust path into an official runtime install. Injected rows now carry an internal builtIn flag that the field-by-field catalog parser never produces; rendering and install routing key on the flag, and the source string is purely diagnostic. * fix(agent-core-v2): include MCP server enablement in capability readiness A user who disabled the kimi-cu stdio MCP server (/plugins mcp disable) got a ready capability with no Computer Use tools in new sessions: the plugin step only checked the plugin toggle, and installPlugin's upsert preserves per-server state. Readiness now requires every declared MCP server enabled (reporting e.g. mcp 0/1 enabled), and setup re-enables disabled servers alongside the plugin toggle. * fix(agent-core-v2): shell-quote ditto paths in the elevated KimiCU copy The elevated fallback escaped paths only for the AppleScript string delimiters, not for the /bin/sh command line inside do shell script: a TMPDIR with spaces broke the install, and shell metacharacters in the temp path could inject commands into an administrator-privileged script. Paths are now POSIX single-quoted first, then the assembled command is AppleScript-escaped. * fix(agent-core-v2): never break a working KimiCU on a failed update The reinstall stopped and uninstalled the old service before the downloaded archive was unpacked: a corrupt or captive-portal zip then tore down a previously ready setup. The archive is now staged and unpacked first, and the app step additionally requires the bundle's Info.plist, so a partially copied bundle reads as missing and gets re-copied instead of failing registration against a corrupt bundle. * fix(agent-core-v2): limit the fetch deadline to the header phase The 30s AbortSignal stayed attached for the whole request, so a slow-but-healthy download of a large archive was aborted at 30s total even while chunks kept arriving — exactly what the per-chunk idle watchdog was meant to allow. The header phase now uses an AbortController cleared once headers arrive; the body remains governed by the inactivity watchdog alone. * test(tui): provide the harness plugin facade in the capability command fakes The lazy-session refactor routes session-less plugin calls through host.harness; the fake host now mirrors that shape.	2026-08-04 17:59:16 +08:00