156 commits

Author	SHA1	Message	Date
github-actions[bot]	f6ee44e426	ci: release packages (#2710) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-12 11:45:35 +08:00
liruifengv	3c9e3b297c	feat(kimi-code): paginate the session picker list (#2826) ... * feat(kimi-code): paginate the session picker list The /sessions picker and kimi -r used to materialize the full session list before showing anything, which gets slow with hundreds of sessions. - node-sdk: add listSessionsPage (limit/before -> items + nextCursor); the v2 engine pages through the session index (draining past entries whose workDir is unrecoverable), the v1 engine answers one full page - TUI: open the picker on the first page, fetch the next page when the cursor reaches the fetched end, and drain remaining pages in the background once a search query is typed so search still covers all sessions - kimi -r now fetches a one-item page for the latest session * chore: simplify session picker changeset * fix(kimi-code): join in-flight page fetch in session search drain A query typed while a scroll-triggered page fetch was still running stopped the background drain at the loadingMore early return, leaving the search covering only the pages fetched so far. fetchMoreSessions now optionally joins the in-flight fetch and continues with the next page; scroll triggers still drop when busy.	2026-08-12 11:21:43 +08:00
HydrogenE7	158c81d705	fix: surface a readable error when Git Bash is missing on Windows (#2814) ... * fix: surface a readable error when Git Bash is missing on Windows * fix(agent-core-v2): translate probe rejection into HostProcessError for ready awaiters - HostEnvironmentService.ready now rejects with the translated HostProcessError(shell.git_bash_not_found) instead of the raw ProbeShellNotFoundError, matching what sync field reads throw and what SDKRpcClientV2.ensureConfigFile() surfaces, while an internal no-op handler keeps the rejection from becoming an unhandledRejection. - Replace the Windows-gated probe-failure tests with vi.mock-stubbed deterministic suites that run identically on any platform. - Move the ProbeShellNotFoundError explanation into the environmentProbe file header per the package comment convention. * fix(agent-core-v2): narrow probe error to Error to satisfy only-throw-error lint * fix(agent-core-v2): preserve probe error as cause when translating to HostProcessError * fix(agent-core-v2): keep checked paths out of the public probe error message * fix(node-sdk): gate the host-environment wait in ensureConfigFile to Windows The missing-Git-Bash failure is Windows-only, and IHostEnvironment.ready also covers the login-shell PATH enrichment, which spawns the user's login shell with a 5s timeout. Awaiting it on POSIX coupled config-only commands (kimi provider list/remove, export, ...) to the user's shell profile for no benefit. --------- Co-authored-by: liruifengv <liruifeng1024@gmail.com>	2026-08-11 21:13:08 +08:00
Haozhe	e702817124	fix(agent-core-v2): degrade idle-session steer to turn launch like v1 (#2723) ... - return the enqueue-launched turn instead of rejecting with prompt.not_found when no prompt is pending at steer time - report steer as queued when a manual compaction holds the context - sync title/lastPrompt metadata on main-agent steer, matching v1 - update the v1-v2 parity test to assert converged behavior	2026-08-11 14:40:15 +08:00
Liu Zhongnuo	437a1b8ba1	fix(sdk): probe MCP auth status through connection (#2731)	2026-08-07 22:18:53 +08:00
Liu Zhongnuo	0b2e803d5e	feat(sdk): expose global MCP auth status (#2706)	2026-08-07 13:11:18 +08:00
Haozhe	7cd64766c8	feat: isolate the full-text search index from the session index and the main thread (#2701) ... * feat(minidb): instrument open lifecycle with phase timings and status Add MiniDb.lifecycleStatus() exposing the no-generation/generation-load/ wal-catch-up/full-rebuild/ready/degraded state machine plus per-phase timings (generation candidate load, store/non-text/text image load, postings integrity check, WAL scan/apply, full recovery, text rebuild hosting), so snapshot load, WAL catch-up and full rebuild can be told apart in diagnostics. Also add a repeatable open-lifecycle bench (small data, large WAL delta, large full-text generation, corrupt generation) and fixtures proving a healthy generation open performs no full-corpus tokenization while a corrupt or missing generation falls back. Log search-index and query-store open diagnostics in kap-server and agent-core-v2 so a listSessions call can be attributed to the database it touches. No persistence format or product behavior change. * feat(agent-core-v2): isolate the session index from the global search index Harden the separation between the session read model and the full-text search index so session operations never depend on search availability: - Reject text index definitions in MiniDbQueryStore at definition level, keeping the session query-store a structural-only read model with no postings/tokenizer artifacts, and assert its generation carries no full-text files. - Share one authoritative scan between the first list and the initial projection (single-flight) instead of scanning twice; reads may only join an in-flight scan, and every fallback read folds the mirror's pending queue so read-your-writes holds while preparing. - Keep withReadModel() fallback semantics pinned by tests: uninitialized/preparing reads hit authoritative metadata immediately, ready reads use the read model, degraded keeps falling back with a diagnosable status reason. - Guard session metadata writes so a mirror failure degrades only the read model and never fails the session lifecycle. - Prove via tests that listSessions/--resume/--continue never open the global search DB (including when search-index is unopenable), and that only real full-text search requests report building/stale/degraded. * perf(minidb): slice open-time work so it never blocks the main thread Make the whole generation-open path cooperative: - Replace the synchronous postings/store CRC verification with chunked async variants (readGenerationFileCheckedAsync, verifyFileIntegrityAsync) that keep the exact bytes/crc-mismatch error semantics. - Give the WAL-delta apply a primitive-op + wall-clock budget (walApplySlicer), so a batch frame unrolling into thousands of ops can no longer run as one uninterruptible slice; torn-tail, corrupt-batch and read-only behaviors are unchanged. - Slice the big attach loops: Store.bulkLoadRefsAsync + SkipList.bulkLoadAsync for the store image, async parsers and loadImageAsync for secondary/compound images, and TextIndex.attachImageAsync for the docs/dictionary map construction. - Queue text builds on worker-slot pressure (WorkerSlots.acquireBounded, bounded by MiniDb.textBuildSlotWaitMs, abort-aware) instead of falling back to an unbounded inline build; a persisted drought hosts the bounded inline core as the explicit last resort with stats accounting. Bench (bench/open-lifecycle, seed 42): event-loop delay max across the four open scenarios drops from 45/734/331/492 ms to ~12-28 ms with wall time flat or better. * feat(kap-server): run the global search index in a dedicated worker Move the whole search-index MiniDb lifecycle (open, generation load, WAL replay, sync, rebuild, compaction) off the main thread into a long-lived worker_threads host, so it never shares the event loop with TUI input: - Add a versioned request/response protocol and worker entry hosting a host-agnostic SearchIndexCore; the same core also backs an inline backend kept as the explicit rollback (KIMI_CODE_EXPERIMENTAL_SEARCH_WORKER=false, flag default ON). - The worker exclusively owns the search-index handle. The lock token is reported at acquire time (new MiniDb OpenOptions.onLockAcquired hook) and reaped on dirty exit; an orphan-lock detector (same-pid lock row whose token no live holder owns) recovers the window where the token report is lost, so a mid-open crash can never freeze the index into a silent permanent read-only. - Crash handling: in-flight requests are rejected with typed errors, respawn uses capped exponential backoff, per-request watchdogs terminate wedged workers, and beginClose propagates into the worker so dispose stays bounded during a long sync. Page tokens pin a boot-salted generation, so tokens issued before a transparent worker restart fail closed with invalid_page_token. - The main process keeps the sync coordinator (debounce/coalescing/ single-flight), live transcript routing, query normalization and page-token codec; searches keep reading the published generation and report building/stale/degraded instead of waiting for sync/rebuild. - Wire the worker into the CLI packaging: self-contained worker bundles for npm dist and the SEA asset manifest/installer/smoke check, plus a dev runtime (type-stripping + .ts resolve hook) scoped to worker execArgv. * feat(kap-server): model search and session-index lifecycles explicitly Consolidate the two-index separation into explicit, diagnosable lifecycles: - Surface the global search state machine (stopped / opening / building / ready / degraded / closing) end to end: SearchIndexCore.lifecycleState, SearchWorkerHost lifecycle snapshots cached from RPC responses (and invalidated across worker generations), a never-throwing status() carrying the lifecycle, and a synchronous lifecycleReport() that neither kicks the open nor spawns the worker. Corrupt search-index rebuilds are announced with a dedicated warn log so building, stale, degraded, corrupt and worker-unavailable stay distinguishable. - Turn MiniDb read-only replica catch-up fully cooperative: catchUpWalAsync scans frames with the windowed async scanner and yields per primitive op on the shared walApplySlicer budget, while a per-instance catchUpChain serializes concurrent catch-ups so each caller keeps its atomic watermark advance. The stale synchronous implementations are removed. - Pin the dependency direction and availability timing with tests: session list/create/resume survive a corrupt or unopenable search index (also end-to-end with a dead query-store), search generation reuse and stale-serving keep working across restarts, concurrent cold callers open the index / spawn the worker exactly once, resume-then- fetchSessions performs no duplicate authoritative scan, and a clean dispose releases the lock and settles at stopped. - Document the experimental flag surface (persistence_minidb_readmodel, search_worker) in the root guide. * feat(agent-core-v2): default the session read model on and roll out the separation Rollout and validation for the index separation plan: - Flip persistence_minidb_readmodel to default ON (rollback via KIMI_CODE_EXPERIMENTAL_PERSISTENCE_MINIDB_READMODEL=false or the experimental config section); session list/--resume/--continue now always go through the isolated session read model with the authoritative fallback. Test harnesses pin the flag off where shared fixtures require hermetic homes, while the dedicated suites keep explicit on/off coverage. - Add a probe proving the main thread stays responsive while the search worker rebuilds and swaps a generation (reindex), completing the TUI responsiveness matrix. - Record the rollout state in the agent-core-v2 guide (session index section) and the root flag line. - Add changesets for the CLI (worker isolation, session index independence) and minidb (cooperative open lifecycle). Validation: full suites green across minidb (551), agent-core-v2 (4760), kap-server (1005), node-sdk (343), klient (91) and the CLI app (2567); open-lifecycle bench event-loop delay max is down from 45/734/331/492 ms to ~16-22 ms across the four scenarios with wall time flat or better. * fix(agent-core-v2): evict deleted sessions from the mirror queue and drain the index on close Two issues surfaced by the read-model default in the acp-server suite: - ISessionIndex.remove only deleted from the query store, but a summary still queued in the mirror was folded back into reads (and re-written by the next flush), resurrecting a deleted session in listings. The mirror now exposes evict(id): drop the queued summary and wait out an in-flight flush before the store delete. - RunningAcpServer.close and SDKRpcClientV2.close disposed the engine without awaiting the asynchronous mirror flush / query-store close, so a host removing homeDir right after close() raced in-flight shard closes (ENOTEMPTY). Both now follow the kap-server shutdown order: drain the mirror while the store is open, dispose, then await the drains. * fix(minidb): pause active expiry during the sliced bulk load The store's active-expire timer is armed at construction, so during a sliced bulkLoadRefsAsync a tick can fire mid-load: it reaps a TTL key from the map while the order skiplist is still the old empty one, and the final bulkLoadAsync then rebuilds order from the stale orderEntries snapshot — resurrecting the expired key in the ordered index (and duplicating it if the key is later set again). The sync bulkLoadRefs had no yield windows, so guard the async path with a bulkLoading flag that defers expiry ticks until the load settles (finally-safe). * chore: consolidate changesets into the TUI startup freeze fix	2026-08-07 07:38:16 +08:00
github-actions[bot]	f0614c53e5	ci: release packages (#2641) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-06 21:56:49 +08:00
qer	335588e259	feat(agent-core-v2): persist the last turn outcome into session metadata for cold listings (#2666) ... * feat(agent-core-v2): persist the last turn outcome into session metadata for cold listings A cold session (no live handle) reported no lastTurnReason, so after a server restart the session list could not mark a session whose last turn failed until it was opened and resumed. A new Session-scope SessionOutcomeRecorder subscribes to the activity aggregate's turn_ended changes and persists the outcome (completed/failed) into the session metadata document; the summary pipeline (mirror + cold reader) carries it as SessionSummary .lastTurnReason, and toWireSession falls back to it when no live fact exists. 'cancelled' is deliberately not persisted: it is also what an in-flight turn ends with during scope disposal, and writing there races the host's home-dir teardown. Verified end to end with an isolated home and a dead provider: a turn fails, the server restarts, and GET /sessions reports last_turn_reason=failed without opening the session. * fix(klient): carry lastTurnReason/lastTurnOutcome in the validated contracts Review follow-up: zod strips unknown keys on parse, so the new outcome fields never reached klient callers; add them to the session summary and metadata/patch/key schemas (contract parity test covers the engine mirror). * fix(agent-core-v2): persist user-cancelled outcomes, never teardown aborts Review follow-up: skipping every 'cancelled' left a stale earlier outcome in the metadata (e.g. a prior failed reported for a session whose latest turn was stopped by the user). The recorder now subscribes to the main agent's turn.ended facts directly and keys on interruptReason: user_cancelled is persisted like any other terminal state, while programmatic aborts — including the cancel every in-flight turn suffers during scope disposal — are never written, so no metadata write races the host's home-dir teardown. * fix(kap-server): only fall back to the persisted outcome for cold sessions Review follow-up: a warm session that just started a new turn clears its live lastTurn, and the unconditional ?? fallback would then report the previous turn's persisted outcome for a turn that is still running. SessionFacts now reports whether a live handle exists, and the wire projection only reads the persisted value when the session is cold. * docs(agent-core-v2): keep the outcome-recorder header at role level * fix(agent-core-v2): settle turn outcomes on turn start and drain metadata writes on close Review follow-ups: - a new main turn now clears the persisted outcome (turn.started), so a process that dies mid-retry no longer reports the previous turn's terminal state for a turn that never ended - the dedupe marker only advances after a successful write, so a failed persist no longer suppresses the next identical outcome - session metadata writes are tracked in a module-level pending set with drainSessionMetadataWrites(), awaited by kap-server close alongside the mirror/query-store drains — an event-driven write (e.g. the outcome recorder) can no longer land in a session dir while the host removes it * fix(agent-core-v2): track the metadata dispose flag locally Disposable exposes no public isDisposed accessor; keep a class-local flag set in the dispose override. * fix(kap-server): drain session metadata writes before the mirror and disposal A write still in flight when close() begins must settle before the mirror flushes its summary into the read model and before scope disposal marks the service disposed — not after. * fix(agent-core-v2): reattach the recorder when the main agent is recreated Review follow-up: a failed bootstrap still fires onDidCreate before the handle is dropped; the subscription then pointed at a dead bus and the guard blocked any later reattach. Track onDidDispose and reset so the next main creation attaches cleanly. * test(agent-core-v2): resolve the recorder through the scoped DI harness Review follow-up: construct SessionOutcomeRecorder via registerScopedService + a Session-scope test host (stubbed lifecycle/metadata), so the test covers the production registration path; add the durable-value adoption case. * fix(agent-core-v2): unbreak CI — iterable Promise.all and the debug channel surface - Promise.all takes the pending-writes set directly (oxlint error) - the disposed flag moves into a _register'd marker instead of a public dispose() override, which the debug channels listing (and its test) correctly rejects as framework plumbing * fix(kap-server): surface persisted failures on the v2 session status The v2 list folds the outcome into activity.status, which previously read only live facts — a cold session always looked idle. Cold sessions now map a persisted failed outcome to status 'failed' (completed and cancelled stay idle, matching the live fold); warm sessions are unchanged, and the statuses filter inherits the mapping. * refactor(agent-core-v2): name the persisted field lastTurnReason Aligns with the established name for the same concept end to end (activity view's lastTurnReason, the v1 wire's last_turn_reason, and the SessionSummary mirror), instead of introducing a third variant. * fix(agent-core-v2): drain pending metadata writes before session teardown Review follow-up: closing/archiving a session right after a turn ended could dispose the scope while the outcome write was still queued, and delete() removes the session dir immediately after close. Await the pending metadata writes before the handle goes away. * fix(node-sdk): carry lastTurnReason through the SDK session summary Review follow-up: the in-process SDK path maps the engine summary through v2SummaryToSessionSummary, which dropped the new outcome field. Add it to the public SessionSummary type and the mapper; the parity gate projects it away (the v1 engine never records an outcome). * fix(node-sdk): populate lastTurnReason on live SDK summaries Review follow-up: resumeSession/reloadSession build their summary from the live session's metadata document, which now carries the outcome — surface it there too so the SDK reports it consistently for live and listed sessions. * fix(agent-core-v2): carry the last turn outcome across session forks Review follow-up: fork skips state.json when copying the session dir, so the fork's fresh metadata never had the outcome and a restart dropped a marker the warm fork was still reporting. The fork's metadata patch now inherits the source's lastTurnReason. * fix(agent-core-v2): settle pending outcome writes before reading a fork source Review follow-up: a fork requested right after the source's turn ended could read the metadata before the recorder's queued write landed, inheriting a stale or absent outcome. Drain pending metadata writes first. * fix(agent-core-v2): backfill restored outcomes into the session metadata Review follow-up: for sessions whose last turn ended before this field existed, the cold-resume seed restores the outcome into the activity view without a turn.ended fact, so the recorder never persisted it and cold listings stayed blank. The recorder now also watches the main agent's activity updates and backfills the restored outcome when nothing is persisted yet. * fix(agent-core-v2): never backfill restored cancellations Review follow-up: a restored 'cancelled' cannot be told apart from a programmatic abort (the activity event carries no interruptReason), and those are never persisted. Backfill now covers only completed/failed; user stops are still persisted from the live turn.ended fact. * refactor(agent-core-v2): rename the outcome recorder to outcome mirror Mirror is the codebase's established term for a write side that reflects live state into a store (SessionIndexMirror); Recorder has no precedent. * fix(agent-core-v2): backfill without bumping recency; header-only comments Review follow-ups: - a mere resume must not float an old session to the top of the list: metadata updates accept touchUpdatedAt:false and the outcome mirror's backfill uses it (live outcome writes keep bumping — turn end is a recency moment) - the mirror service's inline notes move into the file header per the package comment convention - drop the redundant |undefined from the SDK's optional outcome field * fix(node-sdk): read the live outcome for resumed session summaries Review follow-up: on a fresh resume the restored outcome can still be queued as a metadata backfill, so the document may lag a tick; the live activity aggregate already holds it. Resume/reload summaries now prefer the live value and fall back to the metadata field. * fix(agent-core-v2): confine the outcome backfill to pure resumes Review follow-up: the view publishes its turn.ended fold before this mirror's own turn.ended handler runs, so a live ending reached the backfill branch first and got persisted without the recency bump. The backfill now only applies when no turn ever started in this process — live endings always take the bumped write. * fix(agent-core-v2): drain the session-index mirror before session teardown Review follow-up: settling the metadata write alone left the fresh summary in the mirror's pending queue, so a list right after close could read a stale outcome from the read model. close/archive now also drain ISessionIndexMirror. Test harnesses register a mirror stub for the new dependency. * docs(agent-core-v2): fold the metadata drain contract into the file header * chore: include the SDK package in the changeset; fold the drain note into the header * fix(agent-core-v2): backfill restored cancellations too, quietly Review follow-ups: dropping every restored cancel loses legitimate user stops whose live write never landed (or was rejected) before a restart — cold surfaces never mark cancelled anyway, so healing them is harmless and strictly more accurate. The metadata disposal note moves into the file header per the comment convention. * fix(node-sdk): prefer the live outcome over the index in SDK listings Review follow-up: a live session that just started a new turn after a failure can briefly keep the stale outcome in the index while the mirror's clear is queued. listSessions now reads the live activity aggregate for warm sessions, matching the kap-server cold-only fallback. * fix(node-sdk): never read the metadata outcome for a live session Review follow-up: with a retry in flight the live aggregate has no outcome while the document may still hold the previous failure — the fallback showed the stale one. Live summaries now take the live aggregate's answer alone; the restored outcome is already seeded there on resume.	2026-08-06 20:14:05 +08:00
Haozhe	8c766a6c30	feat(agent-core-v2): add the L3 unit layer and the Feature seam (#2678) ... * feat(agent-core-v2): add the L3 unit layer and the Feature seam - introduce the L3 Service/Fiber unit layer: the Service base class with this.provide/effect/on/get/ref capabilities, the fiber runtime with thenable FiberHandles, collection contribution points, and the per-scope-kind ScopeUnits materialization fold - provide each scope's static registration batch as one atomic provideAll cascade transaction (waiting-area activation, sticky Failed on construction error) - add the DI unit inspection surface: App-scope debug ledger / dependency graph / cascade history services and the kimi-inspect DI view - add the Feature unit seam (IFeatureManager + feature assembly), port plan mode onto it, and add the contributed-command seam (agent-command domain + node-sdk RPC types) - remove the legacy dep-graph tooling - apply the header-only comment convention across src and test: strip non-header narration, keep the file header, tooling pragmas, and NOTE comments * feat(kap-server): gate the event.di.* debug feed to kimi-inspect connections - add an opt-in target set in SessionEventBroadcaster; the global fan-out now skips event.di.* frames for connections that never opted in, so kimi-web and other clients no longer receive the high-churn DI feed - WsConnectionV1 opts a connection in when client_hello carries client_id 'kimi-inspect'; removeGlobalTarget drops the opt-in on close - temporary gate until a client-declared event-type whitelist lands * chore(agent-core-v2): fix oxlint errors in the DI unit layer - build the live-ref container chain without aliasing this (no-this-alias) - snapshot the materialized map with Array.from and document why the copy is required (no-useless-spread) * test(klient): use string scope kinds in the lifecycle handle fakes The engine's LifecycleScope is a string enum now; the facade test doubles still returned the old numeric kinds and failed the handleWireSchema output validation. * build(nix): update the pnpmDeps fetch hash	2026-08-06 18:22:36 +08:00
Haozhe	34c4181437	fix(kimi-code): keep kimi -p alive while background tasks are pending (#2675) ... The 10-year default print wait ceiling (315360000s) overflowed Node's setTimeout limit (2^31-1 ms) into a 1ms fire, so the steer/drain wait returned instantly and kimi -p exited right after the main turn, killing pending background tasks and subagents. - add setClampedTimeout in agent-core-v2 _base, clamping delays to MAX_TIMER_DELAY_MS, and route every config-driven timer through it (timeoutOutcome, task wait/manager timeout, swarm attempt timeout) - chunk the print turn-endings wait against the real deadline instead of returning null on the first clamped timer fire - restore v1 semantics: a non-positive swarm subagent timeout is unbounded - default print_wait_ceiling_s to 2147483s (~24.8 days, the timer maximum)	2026-08-06 11:02:34 +08:00
github-actions[bot]	53c832dfdf	ci: release packages (#2592) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-05 16:21:32 +08:00
qer	75fe068a01	fix(cli): stabilize built-in capability installation (#2601) ... * fix(cli): show built-in capabilities before the first session exists The lazy-session refactor left capability calls going through requireSession(), so on a session-less v2 startup /plugins reported the capabilities unavailable and hid the built-in rows behind the promo. Like plugin management, capability readiness and installs are app-global on the v2 engine: the node-sdk harness gains a capability facade over the global channel, and the TUI resolves session-or-harness for every capability call. * fix(cli): count the dev marketplace server as the default catalog dev.mjs always points KIMI_CODE_PLUGIN_MARKETPLACE_URL at its own repo-serving server, which the override gate mistook for a user-configured marketplace and suppressed the built-in capability rows in every dev run. The dev server now marks itself, and the gate treats that marked URL as the default catalog while still honoring real overrides (slash-command source, user-set env, KIMI_CODE_DEV_MARKETPLACE_URL). * fix(cli): align built-in capability updates	2026-08-05 14:55:04 +08:00
Haozhe	f881cdd970	feat(cli): default CLI surfaces to the agent-core-v2 engine (#2627) ... * feat(cli): default to agent-core-v2 engine with KIMI_CODE_LEGACY_FLAG opt-out - invert the engine gate: isKimiV2Enabled() now returns true unless KIMI_CODE_LEGACY_FLAG is truthy; KIMI_CODE_EXPERIMENTAL_FLAG no longer selects the engine - replace the experimental `kimi acp-v2` command with the native v2 implementation as the default `kimi acp`; the legacy acp-adapter path remains under the legacy flag - drop the acp-v2 experimental flag from the registry - rename the dev:cli:v2 script to dev:cli:legacy - update en/zh docs for the new default engine and the legacy flag * feat(cli): route export and provider through the engine gate - select the harness via isKimiV2Enabled(): agent-core-v2 by default, the legacy harness when KIMI_CODE_LEGACY_FLAG is truthy - close the harness after each one-shot command so the v2 engine's watchers do not keep the process alive - document both commands in the KIMI_CODE_LEGACY_FLAG env-var entry	2026-08-05 14:42:23 +08:00
Kai	98ee35afd2	feat(agent-core-v2): add custom agent identity (#2573) ... * refactor(agent-core-v2): simplify context tags and shared copy Rename the context-injection tags to `<skill-loaded>` and `<plugin-instructions>`, drop the product prefix from the CronCreate tool description and the default agent description, and point the MCP OAuth callback page back to "your terminal" instead of naming one client. The callback page is shared by the ACP host, the web UI, and embedding hosts, so naming a single client was inaccurate there. The tags and the two descriptions read exactly the same without the prefix. Verified no runtime consumer matches the old tag names; the updated snapshots cover the tool descriptions that changed. * feat(agent-core-v2): add a switch for the product-documentation skills Five builtin skills document this CLI itself — `update-config`, `custom-theme`, `mcp-config`, `check-kimi-code-docs`, and `import-from-cc-codex`. Their names and descriptions sit in the system prompt on every turn, which is dead weight for runs that will never reconfigure the CLI. Add a top-level `builtin_product_skills` field (also settable through `KIMI_CODE_BUILTIN_PRODUCT_SKILLS`) to drop them. On by default, so nothing changes unless it is set; the trade when off is that the model loses the guided flows for those tasks. Filtering happens where the catalog is assembled — a later filter would leave the skills advertised to the model. The whole section is one scalar, so it exercises the section-level env binding branch and needs its own strip: `stripEnvBoundFields` only walks object fields, so an env override would otherwise be written back into `config.toml`. * feat(agent-core-v2): add custom agent identity Add an `[identity]` config section (`name`, optional `slug`, both also settable through `KIMI_CODE_IDENTITY_NAME` / `KIMI_CODE_IDENTITY_SLUG`) that sets the identity the agent presents: the name it calls itself in the system prompt, the `User-Agent` product token sent to third-party providers, and the client name announced to MCP servers. Leaving it unset changes nothing. Until now every one of these was fixed, which left no way to run the agent as part of another product — an internal deployment, a fork with its own branding, an embedding host. The identity resolves inside the engine rather than being seeded by each host, so it applies to every launch surface — including headless runs, which today seed no display name at all and fall through to the built-in default. Two deliberate asymmetries: - The display name is a filling value with a fallback chain (config > host-declared > the consumer's own default); the slug is a rewriting value with two states only, so with no identity configured the rewriting paths are equivalent to not existing. - The rewrite happens in the outbound header assembly, the one layer that knows which vendor it is building for. Vendors declaring `hostHeaders: 'full'` keep the host's own product token, which that header set is built around and which backends key on; the configured identity applies to the third-party path. Resolution is lazy throughout: config loads asynchronously, and a constructor snapshot would freeze the pre-load value under some startup orderings. Two input edges the resolver has to absorb, since both would otherwise reach the User-Agent builder and either break it or quietly rewrite the header: blank and whitespace-only values read as unset in the file just as they already did in the env, so a stray `name = ""` cannot claim an identity; and a name that folds away to nothing under slug normalization (a CJK-only name, say) falls back to a neutral token rather than producing a blank product, which the builder rejects. * fix(agent-core-v2): keep the file value when a scalar env binding fails to parse `config.ts` documents that an env value failing its binding's `parse` is ignored, and `applyEnvBindings` honors that for object fields by assigning only when the resolved value is defined. `applySectionEnv` returned the parse result straight through for whole-section scalar bindings, so a blank or mistyped variable resolved to `undefined` and cleared the configured file value instead of being ignored. Nothing hit this before: every existing section either binds object fields or is env-only. `builtin_product_skills` is the first whole-section scalar binding, where exporting an empty or misspelled `KIMI_CODE_BUILTIN_PRODUCT_SKILLS` would silently undo a configured `false`. * feat(agent-core-v2): extend the custom identity to discovery and global MCP Two outbound paths still announced the built-in product name under a configured identity: - `DiscoveryService` read the host User-Agent straight from bootstrap args when refreshing provider models, so custom registries — which are third-party endpoints — saw the original token while chat requests to the same class of endpoint saw the configured one. - `SDKRpcClientV2` builds its own global `McpOAuthService` plus a throwaway `McpConnectionManager` for server testing, neither of which goes through the workspace-owned manager that carries the resolver. Both now resolve the identity from the App scope. * refactor(agent-core-v2): neutralize remaining copy and align comments The synthetic MCP authentication tool description is injected into the model context and still named the product; it and the OAuth callback pages now use client-neutral wording. "Return to your terminal" was no improvement over naming a client — both assume what the host is, and that page serves the ACP host, the web UI and embedding hosts alike. Comments introduced by the identity work move into their module headers, per the domain convention. Interface field docs stay: the rule names functions, methods and statements, and field-level docs are established across the codebase. The new tests gain scenario headers and dispose the scoped hosts they create, and the `[identity]` docs state which engine reads the section. * fix(agent-core-v2): read the product-skill switch after config is ready `BuiltinSkillSource` is the lowest-priority skill source, so the workspace catalog loads it first — before `IConfigService` has finished loading — and keeps the contribution it returns for the life of the handler, with no reload path and no change event. Reading `builtin_product_skills` eagerly therefore stranded the startup configuration: an explicit `false` could be ignored for the whole process. `UserFileSkillSource` already awaits config readiness for exactly this ordering; this source now does the same. Also record the identity collaborator in the two module headers that gained the dependency without documenting it, and scope the `builtin_product_skills` docs to the engine that reads it, matching the note the identity section already carries. * fix(agent-core-v2): apply the product-skill switch to session-less listings `builtin_product_skills = false` only reached the scoped skill source. The SDK's `listWorkspaceSkills` and the server's `GET /workspaces/{id}/skills` both composed the raw `BUILTIN_SKILLS` constant, and the web app feeds its pre-session onboarding menu from that route — so the five product skills stayed listed until a session existed, then vanished from the session's catalog. Move the decision into `visibleBuiltinSkills(enabled)` next to the constant and route every consumer through it, reading the switch via the shared `builtinProductSkillsEnabled`. Keeping "what counts as a product skill" in one place is the point: three copies of the predicate would drift the next time a builtin is added. The SDK listing also awaits config readiness, which it did not do before. * fix(node-sdk): await config before materializing the global MCP OAuth provider `McpOAuthService` caches providers by store key and stamps the client name when it first builds one, and the preceding `globalMcpConfig.get()` reads `mcp.json` directly rather than through `IConfigService`. So a `beginGlobalMcpServerAuth` call made right after the harness is created could resolve the identity before config finished loading, pinning the built-in label for the rest of the process — including the OAuth dynamic registration a third-party MCP server records. `testGlobalMcpServer` already awaited config readiness for its own reasons; this path now does too. * refactor(agent-core-v2): drop the unused builtin-skill registrar `registerBuiltinSkills` stamped the raw constant into a catalog for "edge composition without a Session" — exactly the shape that now has to respect `builtin_product_skills`. It has no callers in v2 and is not exported from the package index, so it was dead code that also stood as an invitation to bypass the switch. v1 keeps its own copy. Every remaining path composes builtins through `visibleBuiltinSkills`. * fix(agent-core-v2): send the configured identity on custom-registry imports `:import_registry` fetched a user-supplied third-party URL with a hardcoded `kimi-code-kap-server` User-Agent, so the first request to a registry announced the product while every scheduled refresh of the same registry announced the configured identity. The hardcoded value was wrong on its own terms too: that token names the server, and this path also runs in the CLI. Both services now project the identity through `identityUserAgent`, which carries the two guards (no host header, or no identity) once instead of per caller. The model catalog keeps an inline copy on purpose — kosong is a foundational layer and must not import an app domain. Sweeping the remaining outbound User-Agent sources found no further gaps: WebFetch deliberately sends a Chrome-like UA, the models.dev catalog fetch sends none from the CLI, and kap-server's `user-agent` reads are inbound. * docs: scope the identity env vars and condense the changeset The environment-variable reference advertised all three new variables without noting that only the agent-core-v2 engine reads them; the configuration page already carried that note. Added in both locales. The changeset had grown into two paragraphs of implementation detail, which is what would land in the CLI release changelog. `gen-changesets` asks for one short sentence plus at most a one-line usage hint. * docs(agent-core-v2): describe the identity as what the agent calls itself The module headers had drifted into describing the feature by what it keeps off the wire rather than what it configures. Reworded so they state the capability: the identity is the name the agent uses for itself, and the unset case is a no-op rather than something "safe". The product-skill switch excludes skills rather than hiding them. Wording only; behavior and structure unchanged. * test(agent-core-v2): cover the identity on custom-registry imports The import path switched from a hardcoded `kimi-code-kap-server` token to the host User-Agent projected through the identity, but nothing asserted it. Two cases pin both halves: a configured identity reaches the request, and an unconfigured one leaves the host header intact — the second matters because a single case would also pass if one hardcoded value had simply replaced another. Both fail against the previous implementation. * fix(node-sdk): guard every global MCP OAuth path behind config readiness `McpOAuthService` caches providers by store key and stamps the client name when it first builds one, so any path that can materialize a provider has to run after config has loaded. `beginGlobalMcpServerAuth` awaited readiness, but `resetGlobalMcpServerAuth` reaches the same cache through `invalidate()` -> `getProvider()` without waiting: resetting auth right after the harness is constructed pinned the built-in client name, and the await added to the begin path could not help because it then reused that cached provider. Rather than add the missing await, the accessor is now async and holds the guard itself, so the service cannot be obtained before config is ready and a future entry point cannot forget. The remaining `configReady` in `testGlobalMcpServer` stays — that one is for its own `[mcp]` section read. * fix(agent-core-v2): send the configured identity on models.dev requests The directory fetch behind `listModelsDevProviders` / `getModelsDevProvider` still hardcoded a `kimi-code-kap-server` User-Agent, so browsing or importing from models.dev announced the built-in product — and claimed to be the server even when running in the CLI. Only the custom-registry import had been fixed. `getModelsDevCatalog` now takes the User-Agent from its caller: the module is plain module-level state with no container access, and the value depends on the host and the configured identity, which only the calling service can see. All four third-party fetches in that service share one helper. Where the host states no User-Agent, a neutral token stands in rather than dropping the header — these are directories the service chooses to call, so there is no host intent to preserve, unlike the provider requests the model catalog assembles. Both new tests fail against the previous hardcoded value. * test(agent-core-v2): assert the product-skill set literally The expected sets were derived from the same `productSpecific` field the production filter reads, so a builtin silently losing its marker would just move between sets and leave every assertion green — while staying visible to the model once the switch is off. The five names are now literal, with a test asserting the marked set matches them exactly. Dropping the marker from one skill now fails four tests instead of none. Also states the App scope in the identity contract header, per the domain's comment convention for contract files. * fix(agent-core-v2): normalize the host-declared display name too Blank and padded values were normalized on the config side but not on the host fallback, so an embedding host passing `displayName: " "` rendered "You are ," into the system prompt, and a padded name kept its padding. Same rule now applies to every source of the name. Also names `agentIdentity` as the collaborator in the request-headers adapter header, which described the value it obtains without saying which domain resolves it. The three new cases fail against the previous implementation. * fix(agent-core-v2): keep the configured slug when the host sends no User-Agent The neutral fallback added for hosts that state no `User-Agent` discarded a configured identity along with it: `identityUserAgent` returns `undefined` as soon as there is no host header to rewrite, so `?? DEFAULT_IDENTITY_SLUG` sent the literal `agent` even when `[identity].slug` was set — precisely the case that fallback exists to serve. The configured slug now stands on its own, with the neutral token reserved for having neither. The four combinations of (host header, configured slug) had three tests; the missing one is the one that was wrong. It now fails without this change. `outboundUserAgent` also awaits config readiness before reading the identity, so a browse issued right after bootstrap cannot send the pre-load value — the guard lives in the accessor rather than at its four call sites, matching how the same race is handled elsewhere in this branch. Both headers here and in `discoveryService` now name `agentIdentity` as the collaborator resolving that token. * test(acp-server): follow the renamed skill-activation tag `acp-server` arrived on main after the tag rename, so its two assertions still expected `kimi-skill-loaded` and failed once the branches met. Also updates the web app's CSS comment, which named the old tag from the start of this branch — a comment, so nothing ever failed on it. Found by CI: the merge verification only ran agent-core-v2's suite, and this package is neither a dependency nor a dependent of it. * fix(agent-core-v2): present the configured slug on registry refreshes too The previous round taught the import path to fall back to the configured slug when the host states no `User-Agent`, but left the scheduled refresh of the same registry on the bare projection — so one registry could see `acme` on import and the runtime default on refresh. Extracting `identityUserAgent` had made the two paths share a function without sharing the policy. The choice itself is now the shared piece: `identityUserAgentOrDefault` always yields a value, for the directories this process chooses to call, while `identityUserAgent` stays the form that rewrites only what the host already sends — what a provider request needs, where the host's silence is its own choice. * docs(agent-core-v2): move new member docs into the module headers The domain's comment convention is absolute — comments live solely in the top-of-file block — and I had read the "functions, methods, or statements" clause as leaving interface members out. It does not: only 25 of 734 v2 sources carry an indented block, so the members I documented were the exception, not the pattern. Seven members across six files move into their headers. `types.ts` had no header at all, so it gains one. * fix(agent-core-v2): connect session MCP overlays after config is ready The shared manager reaches `connectAll` through `initialize()`, which awaits the config domain first; `sessionOverlay` called it straight away. A session carrying ephemeral `mcpServers` created right after bootstrap therefore resolved the client name before config had loaded and initialized under the built-in one. The blast radius is wider than that one connection: a remote server sends the overlay through `hasTokens()`, which materializes an OAuth provider on the *shared* service and caches it by store key — so the early name outlives the connection that raced. The overlay now connects behind `mcpConfig.ready`, leaving the returned readiness promise unchanged. * fix(agent-core-v2): reload builtin skills when their switch changes The workspace catalog keeps each source's contribution for the life of the handler, so a `builtin_product_skills` toggle never reached an existing handler's sessions. That was harmless while every surface read the same constant — but routing the session-less listings through the config made the two views disagree, since those read the switch on every call. Follows `ExtraFileSkillSource`: subscribe to the owning section and fire `onDidChange`, which the catalog already turns into a source reload. The test asserts an unrelated section does not trigger it. * fix(agent-core-v2): apply the identity to self-configured web services `[services.moonshot_search]` and `[services.moonshot_fetch]` name their own `base_url`, so both services can point at an endpoint the user chose — but each forwarded the host request headers verbatim, sending the built-in product token there under a configured identity. Only the services-config path is rewritten; the managed OAuth path keeps the host headers as they are, being the endpoint the session authenticated against. The distinction is the same one the model catalog draws per vendor. `identityHeaders` carries the rewrite across a whole header set, so this is the fourth caller sharing the projection rather than repeating its guards. A pair of tests pins both halves. My earlier sweep classified these two as official by their names instead of asking who chooses the URL, which is why they were missed. The contract header is also condensed here, per the convention below. * docs(agent-core-v2): condense the identity headers to their contracts The comment convention is one sentence with two halves — comments live only in the top-of-file block, *and* that block states the module's role without narrating implementation. Moving the member docs up last round satisfied the first and broke the second: the headers ended up spelling out the slug folding algorithm, the strip mechanics, and the load order. Kept what a caller or the next editor would get wrong without it (why the value is read rather than snapshotted, what `undefined` obliges a consumer to do, why this source waits for config). Dropped what the code already says. 22/12/12/13 lines, against 53 in `catalogService.ts` — length was never the problem. * fix(agent-core-v2): rebuild active prompts when the builtin skills change Reloading the catalog on a `builtin_product_skills` toggle left existing agents holding the old listing: `AgentProfileService` refreshes the prompt only for the plugin source, so a disabled switch kept advertising skills that were gone, and enabling it left them missing until an unrelated refresh. The plugin source is special because it also contributes prompt sections (#2314), and the file-backed sources are left out for cost — their fs watches would rebuild every agent's prompt on each edit. The builtin source has no watch: it changes only when its config switch is toggled, so it belongs with the plugin source rather than with the file ones. Subscribing to the catalog rather than the config section is load-bearing. The catalog fires after the contribution is replaced, whereas a config subscription would race the reload, and `resolveSkillListing` only awaits the catalog's *initial* readiness — so the rebuilt prompt could read the listing it was meant to replace. The source id is a named constant now, so the subscription does not match on a bare string. * refactor(agent-core-v2): freeze the agent identity for the process lifetime The identity is announced outward (MCP initialize, OAuth registration, provider request logs) and cannot be re-announced, so mid-process changes could only ever apply partially. Resolve it once when config first loads and hold it for the life of the process: IAgentIdentity now hands out a frozen snapshot via resolved()/current(), carrying finished products (outbound User-Agent variants, rewritten header set) so call sites stop composing host headers with the slug themselves. The kosong host-headers port carries two finished layers and the catalog only picks one; consumers gain no invalidation obligations because the value can never change after the freeze. [identity] edits take effect on the next start (documented). * fix(agent-core-v2): locate the User-Agent header case-insensitively HTTP header names are case-insensitive, but the snapshot builder looked up 'User-Agent' by exact key: an embedding host spelling it 'user-agent' got no third-party UA and kept its own product token on the services path even with an identity configured. The builder now locates every case variant and rewrites each in place, keeping the host's spelling. Also corrects the two web-service headers that still described both paths as sending the bootstrap headers, naming agentIdentity as the collaborator behind the config path, and documents that a resumed session keeps its recorded system prompt. * fix(agent-core-v2): attribute header provenance from the finished third-party layer Inspection reconstructed the non-full host layer from the raw headers with an exact-case 'User-Agent' lookup, so a host spelling the header 'user-agent' got a resolved User-Agent with no provenance entry even though the runtime sends the rewritten value. buildModel now captures the port's finished third-party layer in the trace and attribution reads it, keeping inspect() on the same resolution pass as get(). Also condenses the identity contract header to its external role, and documents that an existing MCP OAuth authorization keeps the client registration it was granted under (reset the server's auth to register under the new identity). * fix(agent-core-v2): keep web tool backends from racing the identity freeze An env-configured [services] endpoint is visible before config finishes loading, and FetchURLTool / WebSearchTool materialized their backends at construction — so a fast bootstrap could hit the identity snapshot's pre-freeze guard during agent creation, and the composed backend pinned config and login state for the agent's lifetime against the service's documented per-call resolution. Both tools now resolve their backend per invocation, the WebSearch activation gate checks presence alone through the new hasWebSearchProvider() (no provider composition, no identity read), and bind() awaits the identity freeze before materializing the model, whose resolution reads the identity through the host-headers port.	2026-08-04 22:35:15 +08:00
qer	0abcd00f7f	feat(cli): add built-in Computer Use and WebBridge capabilities (#2407) ... * feat(agent-core-v2): add built-in capabilities (kimi-cu, kimi-webbridge) with REST routes Add a capability domain holding a closed registry of built-in product capabilities. Each entry owns layered readiness detection and idempotent install orchestration: binary runtimes from fixed official CDN URLs (KimiCU.app + launchd service + TCC permission state; the WebBridge daemon with start-if-down semantics for Kimi Work coexistence) plus agent wiring through the plugin service. The WebBridge wiring un-shadows stale user-source skill copies (user priority beats plugin priority). kap-server exposes the domain as GET /api/v1/capabilities, GET /api/v1/capabilities/{id}, and POST /api/v1/capabilities/{id}:install with client-polled progress and new wire codes 40418 / 40922 / 40923. The plugin marketplace gains an official kimi-webbridge entry (browser-control skills) packaged by the existing CDN build. * fix(agent-core-v2): rename the webbridge wiring plugin to kimi-webbridge-skill An official kimi-webbridge guide plugin (install/remove setup skills, v3.0.4) already exists at the marketplace path the capability installer pointed at — a different artifact owned by another release line. Give the browser-control usage-skill plugin its own id/path instead of colliding with (or overwriting) the guide plugin. The capability entry's detect/install now tracks kimi-webbridge-skill; a machine with only the guide plugin correctly reports the skill layer as missing. * feat(agent-core-v2): shelf installs auto-complete capability binary layers Two changes to make the plugin marketplace a first-class install path: - Marketplace gains kimi-cu (sourced from the CU team's CDN zip — no repackaging) and the kimi-webbridge usage-skill plugin now claims the kimi-webbridge id at v4.0.0, deliberately superseding the WebBridge guide plugin (v3.0.4, install/remove guide skills): guide users get a version upgrade onto the real usage skill. - The capability service subscribes to IPluginService.onDidReload: when a capability's wiring step flips to ok through ANY install path (shelf, TUI, CLI), it auto-completes the missing binary layers (KimiCU.app + service, or the WebBridge daemon). Triggers only on the false→true edge so completed installs with still-missing manual steps (TCC permissions) never retrigger heavy downloads on later reloads. * fix(plugins): keep kimi-webbridge plugin version aligned with the upstream skill The plugin version tracks the bundled official usage skill (1.11.3) so version drift against the WebBridge release line stays visible, instead of minting an independent 4.0.0. * fix(agent-core-v2): never report the webbridge installer-script version as the product version The on-disk ~/.kimi-webbridge/bin/kimi-webbridge.version file tracks the installer's own lineage (3.1.x, bumps on every install/upgrade run), not the product version (v1.11.3 — daemon, extension, and skills all share it). A downed daemon would have shown the misleading installer number; report no version instead (live /status remains the source of truth). * chore(plugins): list kimi-cu on the marketplace without a pinned version Marketplace versions are optional by schema: rows display the version detected from the installed plugin's manifest, and update prompts only fire on a valid semver latest > local comparison. A hand-maintained number would drift just like the guide plugin's did. The locally built kimi-webbridge entry keeps its manifest-stamped version (1.11.3). * fix(agent-core-v2): fire onDidReload on plugin mutations, not just explicit reload installPlugin / setPluginEnabled / removePlugin changed the catalog silently — consumers listening to onDidReload (session skill-catalog convergence, the capability shelf-install hook) only converged on an explicit reloadPlugins(). Fire the same summary-shaped event on every mutation (added:[id] / [] / removed:[id]) so every install path converges. This also unbreaks the shelf-install hook on real hosts: its unit tests passed against a fake emitter that fired on installs, which the real service never did. * feat(kap-server): add plugin management and marketplace REST routes Expose the App-scope plugin service over the wire so non-CLI hosts (desktop, web) can manage plugins end to end: - GET /api/v1/plugins/marketplace — catalog (pluginMarketplaceUrl server option / KIMI_CODE_PLUGIN_MARKETPLACE_URL env / production default) merged on demand with live install state; updateAvailable only on strict semver catalog > installed (no semver dependency) - GET /api/v1/plugins, POST /api/v1/plugins {source} - POST /api/v1/plugins/{id}:{enable,disable,remove} - New wire code 40419 plugin.not_found Mutations flow through IPluginService, so they serialize with other install paths and fire onDidReload (session skill catalogs and the capability shelf-install hook converge). * feat(agent-core-v2): surface a machine-key note from capability installs CapabilityEntry.install now resolves an optional note exposed through CapabilityInstallProgress.note (wire-visible). The webbridge entry returns 'user-skill-migrated' when it replaces a pre-existing user-source skill (from the official installer) with the plugin-managed copy — clients can localize the migration instead of the skill silently disappearing from the user's directory. * feat(tui): let the real WebBridge marketplace entry win over the pinned promo The hardcoded Web Bridge row was built when WebBridge had no plugin package — it pinned above the Official tab and shadowed any catalog entry with the same id (open-in-browser only). Now that the marketplace carries the real kimi-webbridge plugin, flip the precedence: the catalog entry renders and installs normally, and the pinned promo becomes a loading/error/legacy-catalog fallback only. Footer counts keep their old semantics (catalog-only; the promo row is never counted). * fix(tui): dim the installed state so it stops reading as the install action Both badges shared a near-identical green-ish treatment in the same column, making a quiet fact look like a clickable action. States now recede (installed → textDim) while actions stay loud (install → primary, update → warning). * feat(agent-core-v2): converge plugin state across processes sharing a home Multiple hosts share one KIMI_CODE_HOME (CLI, desktop, other agents), but each PluginService kept a private in-memory snapshot: a plugin installed or removed in one process stayed invisible to every other live process until its next restart — new sessions there kept offering stale plugin skills/MCP, and the capability shelf hook never saw peer installs. Watch <home>/plugins for installed.json changes and reloadPlugins (debounced, echo-suppressed around our own mutations) so all consumers converge in well under a second: session skill catalogs, plugin MCP mounts, and the capability shelf-install hook alike. * fix(agent-core-v2): un-shadow webbridge user skills in BOTH user dirs kimi-code resolves user-scope skills from two roots (~/.kimi-code/skills and ~/.agents/skills), both at priority 20 — a stale copy in either shadows the plugin-managed wiring (priority 5), and also keeps the capability working after the plugin is removed, which reads as 'uninstall did nothing'. Migrate copies in both dirs during install; other runtimes' dirs (~/.claude, ~/.codex) remain untouched. * feat(tui): show live runtime-setup progress for capability installs Installing a capability plugin (kimi-cu, kimi-webbridge) from the /plugins shelf kicked off a silent background binary install — the row flipped to installed while megabytes of runtime downloaded invisibly. Route capability entries through the capability surface instead: the panel's inline installing line now mirrors live progress (step + percent) until the install settles, and the transcript reports ready / failure-with-retry / still-running accordingly. Capability removal prints an explicit note that runtime binaries are deliberately left untouched (the capability keeps working), since that read as 'uninstall did nothing'. Plumbs the capability service through klient's global facade ('capabilityService' decorator resolves in-process) and the node-sdk v2 client; Session exposes it with a structural feature-detect so v1 engines fail clearly. * docs(plugins): keep the kimi-cu marketplace blurb accurate for every client Only the capability-aware clients auto-install the KimiCU.app runtime; older builds still get wiring-only (the wrapper's error message then points at the official setup script). Don't overpromise in the catalog text every version reads. * feat(agent-core-v2): install capability wiring from client-bundled plugin copies The kimi-cu / kimi-webbridge wiring plugins ship inside the client release instead of the marketplace catalog, binding their visibility to the client version. Capability installs now resolve the bundled copy (env override, then npm-layout and source-checkout probes from the module) and install it as a local path, replacing the two CDN zip URLs. A missing bundle fails the wiring step with a clear reinstall-or-upgrade message. * build(cli): bundle the capability wiring plugins into client releases Vendor the official kimi-cu plugin (v0.5.4, from the CU team's plugin zip) next to kimi-webbridge under plugins/official, copy both into apps/kimi-code/bundled-plugins at build time, and ship them in the npm package (files) and the native SEA blob (a new bundled-plugins asset set extracted into the native cache at startup, published to the engine via KIMI_CODE_BUNDLED_PLUGINS_DIR). Desktop points the same variable at its extraResources copy. The .gitignore build-output entries are anchored so sources under src/native and test/native stop being silently ignored. * revert(plugins): remove the kimi-cu and kimi-webbridge marketplace entries Both capabilities now distribute with the client (bundled wiring), so the catalog drops back to kimi-datasource / superpowers / vercel-plugin. Older clients never see the entries; current clients install from the Built-in section. This also reverts the marketplace blurb commit 0635e99c5. * feat(tui): add a Built-in capabilities section to the plugins panel The Official tab now opens with a Built-in section fed by the engine's capability registry (kimi-cu / kimi-webbridge): per-row install state (install / finish setup / ready), Enter runs the full capability install with live progress, and unsupported rows hide (kimi-cu off macOS). The WebBridge promo fallback only remains for v1 engines — on v2 the real built-in entry wins. Rows double as the reinstall path: a client upgrade ships newer wiring, and installing again upserts from the new bundle. * docs(plugins): document the Built-in section and refresh the capability changeset * build(nix): stage bundled capability plugins into the SEA build The native SEA blob now embeds the bundled-plugins asset set, so the nix derivation needs the plugins tree in its src fileset and the staging step alongside copy-web-assets before build:native:sea. * revert: drop the client-bundled wiring distribution Built-in visibility is simpler to get by injecting the two capability entries into the marketplace catalog at load time; the wiring plugins themselves keep installing from their fixed official CDN zips. Removes the vendored kimi-cu plugin, the bundled-plugins npm/SEA packaging and flake staging, the engine bundle resolver, and the plugins panel's Built-in section. Keeps the /agents/ and /native/ gitignore anchors so sources under src/native and test/native are not silently ignored. * feat(cli): inject the built-in capability entries into the marketplace catalog The kimi-cu / kimi-webbridge entries are appended by the client at catalog load time instead of being served by the remote marketplace.json, binding their visibility to the client version (older clients never see them). No version is pinned — reinstalling upserts the wiring — and ids the catalog already carries always win. In a source checkout the webbridge entry installs the repo's own plugin copy; packaged builds use the official CDN zip. This reverts the docs paragraph about the Built-in section, which the simpler approach makes unnecessary. * test(tui): select the catalog's own first row in marketplace install tests The client-injected capability entries suppress the WebBridge promo and append after the catalog rows, so Kimi Datasource now leads the Official tab — the extra down-key landed on kimi-cu instead. * feat(cli): surface the built-in capabilities as client-injected marketplace entries The kimi-cu / kimi-webbridge entries are injected into the marketplace catalog by the client (v2 engine, default catalog only) instead of being served remotely, binding their visibility to the client version; injected rows mask same-id catalog rows, so what these ids mean stays decided by the client release — a future official listing only reaches older clients, whose fix is to upgrade. The /plugins panel shows capability readiness on the rows (setup incomplete / installing…), platform-gates kimi-cu to macOS, and Enter finishes the runtime setup with live progress; v1 keeps the plain plugin install path and the WebBridge promo fallback. Capability and plugin calls move from the ad-hoc REST routes onto the typed klient contract (capabilityService next to pluginService), so the public REST surface returns to its pre-feature shape. Detection is presence-only — version pins removed: the current version is always read live (Info.plist, daemon status, install records), installs are detect-first and idempotent so an interrupted setup can be retried, and reinstalling pulls the latest managed artifacts (the passive upgrade path). * ci: retrigger checks * fix(cli): recognize Computer Use CDN plugins as official * fix(cli): keep built-in entries on catalog outage and isolate detector failures Two review follow-ups: the client-injected entries no longer disappear when the marketplace catalog is unreachable (they are not served by it), and a single capability's failing detect probe degrades to a failed step on that entry instead of rejecting the whole listCapabilities call. * refactor(cli): simplify built-in capability integration * refactor(cli): source built-in catalog rows from the engine and tighten detect probes The injected marketplace entries are now derived from the engine's capability registry (listCapabilities) instead of hardcoded client-side copies — the util only owns the mask/append mechanics, and capability ids are no longer pinned in the CLI (the remove note resolves them through the registry too). kimi-cu's detect-path probes (service-status, xpc-ping) get a 3s timeout — they answer in milliseconds when healthy but run on every status listing, so a wedged binary must degrade quickly instead of stalling the panel. Document the Official tab's built-in capability rows in the plugins guide. * fix(cli): answer capability id membership without running detectors listCapabilities() runs every entry's detect probes (seconds on a wedged binary), so using it to decide whether to print the post-remove hint made every plugin removal pay a full detection round. The id set is part of the client/engine contract (mirrored in the klient schema), not product data that drifts — restore the closed-set check. The injected catalog rows keep flowing from the registry. * fix(agent-core-v2): make capability setup recover from disabled, partial, and wedged states Three review follow-ups on the install path: setup now re-enables the wiring plugin when a previous disable survived installPlugin's upsert (detection requires enabled, so it would otherwise strand the capability at partial); the webbridge daemon-binary step verifies the executable bit on POSIX, so an install interrupted between rename and chmod re-downloads instead of failing start with EACCES; and kimi-cu's detect degrades wedged CLI probes (service-status, xpc-ping) to failed steps instead of throwing, keeping the detect-first install able to repair the remaining layers — with the probe timeout injectable for tests. * fix(agent-core-v2): abort capability downloads whose byte stream stalls downloadToFile had no inactivity deadline: a CDN connection that stops producing bytes hung the background install forever, wedging the capability in a permanent installing state (retries rejected as in-progress) until the process restarted. An idle watchdog now fails the download after 30s without a chunk; slow but flowing downloads are unaffected. * fix(tui): stop offering capability setup on unsupported platforms An installed wiring plugin whose capability is unsupported on this OS/arch (kimi-cu off macOS, webbridge on an unknown arch) was treated like a partial setup: the Installed tab showed setup incomplete and Enter routed to installCapability, which the service always rejects. Setup actions are now gated to actionable states (not_installed / partial); unsupported renders as a dim fact and Enter opens details. * fix(agent-core-v2): cover the two remaining install wedge modes Review follow-ups: the KimiCU app step now requires an executable binary, so a ditto interrupted mid-copy reads as missing and the next setup re-copies instead of failing EACCES forever; and downloadToFile's idle budget now also covers the response-header phase via an AbortSignal on the fetch itself, so a connection that never completes headers fails the install (clearing the running state) instead of hanging it. * fix(tui): render capability rows independently of the catalog fetch While the marketplace catalog was loading or unreachable, the Official tab showed only the pinned WebBridge promo — built-in runtime setup was blocked by an unrelated remote fetch, and Enter opened the browser instead of installing. Locally-known capability rows (from the engine registry) now render and install in every catalog state; the promo remains only as the v1 fallback. * fix(agent-core-v2): keep KimiCU cleanup timeouts best-effort stopOldProcesses is documented as || true, but runCommand propagates timeouts: a wedged old binary made kimi-cu uninstall exceed the command timeout and the reinstall died before ditto could replace the app. Cleanup commands now swallow failures (the timeout already attempts a kill) so the replacement always proceeds; the command timeout is injectable for tests alongside the probe timeout. * fix(cli): inject built-in entries only for the default marketplace catalog Injection is part of the default catalog experience: any explicit replacement (slash-command source or KIMI_CODE_PLUGIN_MARKETPLACE_URL) now opts out wholesale — its same-id rows are never masked by the built-ins, and an unreachable custom catalog surfaces its own failure instead of being silently replaced by a built-in-only tab. * refactor: align capability row rendering on the source marker and drop conditional spreads Marketplace-row capability enrichment (status, badges, issue details, platform filtering) now keys on the capability:<id> source marker — the same condition Enter uses to route installs — so a custom catalog row that merely reuses a built-in id renders and installs as a plain plugin. Also replaces the conditional-spread optional fields with direct undefined-valued assignments per the repo coding rules. * refactor(agent-core-v2): move capability comments to the file headers The domain's comment convention allows only the top-of-file block: responsibility and scope context for the recent hardening (detect-first idempotent install, executability gates, probe-failure degradation, best-effort cleanup, download watchdog, per-entry detection isolation) now lives in the module headers, and inline narration beside statements and members is removed. * fix(tui): follow an in-progress capability install instead of restarting it Opening /plugins while a capability setup is already running showed the installing… row, but Enter called installCapability again and the service's duplicate-start rejection (40922) surfaced as a fake failure. The panel now checks the live status first and, when an install is already running, skips the start call and just polls for the existing progress. * fix: align two more replacement paths with their contracts The EXDEV daemon-binary fallback now stages on the target filesystem and atomically renames over the destination instead of opening a possibly-running binary for write (ETXTBSY on Linux). And the panel's fallback capability rows (catalog loading/error) now follow the same default-catalog condition as the loader injection, so an explicitly overridden marketplace fully replaces the Official tab. * fix(tui): make the built-in row marker unforgeable The capability:<id> source string was the trust signal for routing rows into capability installs, but any catalog can write that string — a custom marketplace could smuggle a row past the third-party trust path into an official runtime install. Injected rows now carry an internal builtIn flag that the field-by-field catalog parser never produces; rendering and install routing key on the flag, and the source string is purely diagnostic. * fix(agent-core-v2): include MCP server enablement in capability readiness A user who disabled the kimi-cu stdio MCP server (/plugins mcp disable) got a ready capability with no Computer Use tools in new sessions: the plugin step only checked the plugin toggle, and installPlugin's upsert preserves per-server state. Readiness now requires every declared MCP server enabled (reporting e.g. mcp 0/1 enabled), and setup re-enables disabled servers alongside the plugin toggle. * fix(agent-core-v2): shell-quote ditto paths in the elevated KimiCU copy The elevated fallback escaped paths only for the AppleScript string delimiters, not for the /bin/sh command line inside do shell script: a TMPDIR with spaces broke the install, and shell metacharacters in the temp path could inject commands into an administrator-privileged script. Paths are now POSIX single-quoted first, then the assembled command is AppleScript-escaped. * fix(agent-core-v2): never break a working KimiCU on a failed update The reinstall stopped and uninstalled the old service before the downloaded archive was unpacked: a corrupt or captive-portal zip then tore down a previously ready setup. The archive is now staged and unpacked first, and the app step additionally requires the bundle's Info.plist, so a partially copied bundle reads as missing and gets re-copied instead of failing registration against a corrupt bundle. * fix(agent-core-v2): limit the fetch deadline to the header phase The 30s AbortSignal stayed attached for the whole request, so a slow-but-healthy download of a large archive was aborted at 30s total even while chunks kept arriving — exactly what the per-chunk idle watchdog was meant to allow. The header phase now uses an AbortController cleared once headers arrive; the body remains governed by the inactivity watchdog alone. * test(tui): provide the harness plugin facade in the capability command fakes The lazy-session refactor routes session-less plugin calls through host.harness; the fake host now mirrors that shape.	2026-08-04 17:59:16 +08:00
7Sageer	278b6af19d	fix(agent-core-v2): make MCP initial connect non-blocking during startup (#2586) ... * fix(agent-core-v2): make MCP initial connect non-blocking during startup * Delete .changeset/mcp-nonblocking-startup.md Signed-off-by: 7Sageer <sag77r@hotmail.com> * fix(agent-core-v2): wait for MCP readiness before first turn * fix(klient): wait for MCP startup before listing * fix(klient): keep MCP server listing non-blocking * test(acp-server): allow pending MCP snapshot --------- Signed-off-by: 7Sageer <sag77r@hotmail.com>	2026-08-04 16:47:55 +08:00
liruifengv	2c3c5a5879	feat(tui): lazy-create the session on first use with the v2 engine (#2458) ... * feat(tui): lazy-create the session on first use with the v2 engine Start the interactive TUI session-less under the v2 engine and create the session on first use (message, bash input, or a session-requiring slash command) instead of at startup. Skills and plugin commands are resolved from the workspace/app-global catalogs without a session, and the footer shows config defaults (model, permission, plan mode, thinking effort, context cap) until the session exists. * fix(tui): serialize lazy session creation and carry session-only thinking Concurrent first-use triggers (double Enter, a slash command right after a prompt) both observed `session === undefined` and created their own session, letting the later setSession close the first one mid-dispatch. Share an in-flight creation promise instead. A session-only thinking choice (model picker Alt+S) made before the first session exists only updated appState, so the lazy-created session fell back to the engine default while the footer showed the chosen effort. Carry it as a first-session thinking override and clear it on creation. * fix(tui): don't re-enter plan mode when creating the lazy session The v2 engine applies config.defaultPlanMode at session create time (sessionLifecycleService), so passing the pre-filled appState.planMode as the create override entered plan mode twice and threw 'Already in plan mode' on the first message. Pass only the explicit CLI --plan intent for session-less v2 creation; the config default stays footer-only. * fix(tui): re-check the busy gate after lazy shell startup, keep /settings session-less A bash command submitted while the first prompt is still being lazy-created shared the in-flight creation promise but resumed past handleUserInput's busy check, running runShellCommand concurrently with the prompt. Re-check streamingPhase after the await and queue instead. /settings is a local settings entry point: opening it must not require or create a session, so it no longer triggers lazy creation; its session-requiring sub-items keep their own errors. * fix(tui): re-check busy state after lazy command creation, make /plugins session-free A skill/plugin or idle-only slash command submitted while the first prompt was still being lazy-created shared the in-flight creation promise but resumed past the availability check resolved before the await, running concurrently with the prompt's turn. Re-check the busy gate after the shared await in the skill, plugin-command and builtin dispatch paths. /plugins is app-global on the v2 engine, so a session-less startup no longer creates a session (or fails with LLM-not-set) just to manage plugins: the harness now exposes the global plugin API and the command routes through it until a session exists. * fix(tui): keep the read-only /add-dir forms session-less The bare and `list` forms already tolerate a missing session, but the blanket lazy-create gate forced a session (or failed with LLM-not-set) before they could run. Only the path-adding form needs a live session, so it now lazy-creates inside the handler instead of in the dispatch preflight. * fix(tui): reflect pending dirs in /add-dir list, refresh plugin commands after reload /add-dir list looked only at session.summary, so pending startup additionalDirs were reported as absent until a session existed; fall back to appState when session-less. /plugins reload updated the app-global service but left the TUI's plugin slash-command map stale, so new or re-enabled commands kept parsing as prompts; rebuild it from the reloaded service (which also covers the app-global path before the first session exists). * test(tui): add pluginCommandMap to the MessageDriver interface * fix(tui): hydrate lazy defaults on sessionless reload, guard /plan re-entry /reload refreshed only the model/provider dictionaries while session-less, so defaults edited externally (or a newly added default model) left appState.model empty/stale and the first lazy-created session failed with LLM-not-set or used the old value. Reuse the startup default-hydration path for the no-session reload case. /plan on as the first command with defaultPlanMode=true re-entered plan mode after the engine had already applied the config default at create, throwing Already in plan mode. Skip the call when the session is already in the requested mode. * test(tui): widen the getConfig mock return type for the reload case * fix(tui): clear stale lazy defaults when the default model disappears hydrateLazyConfigDefaults only patched model when the reloaded config still had a default, so removing defaultModel from config.toml left appState.model stale and the first lazy-created session passed it explicitly instead of failing or following the engine's current defaults. Reset model and context cap when the default is gone. * fix(tui): reset a removed permission default, don't re-enter plan on --plan A removed defaultPermissionMode left appState carrying the old elevated mode, which createSessionFromCurrentState then passed explicitly to the first lazy-created session; reset to manual when no CLI permission flag is present. With both defaultPlanMode and --plan set, the create payload passed planMode: true even though the engine already entered plan mode from the config default, throwing Already in plan mode on the first prompt. Track the config default separately and suppress the --plan override when it is already active. * fix(tui): keep read-only and mode commands session-less Read-only views (/status, /usage, /mcp, bare /title) already degrade gracefully without a session, so forcing lazy creation made them fail with LLM-not-set or create an unused persisted session; they no longer trigger creation, and /title <name> lazy-creates only for the mutation. /permission, /auto and /yolo are pending-mode choices: with no session on v2 they now record the mode in appState (which the lazy create path passes to the engine) instead of failing or creating a session just to pick a mode. The runtime permission is applied once a session exists. * fix(tui): wait out lazy assembly in ensureSession, expose workspace MCP setSession assigned host.session mid-assembly, so a follow-up prompt or command in that window skipped the shared creation promise and dispatched against a session whose subscription and runtime sync had not finished. Check the in-flight promise before the assigned-session fast path. /mcp required a live session even though the v2 connection set is workspace-scoped, so it errored until an unrelated prompt created one. Route it through a workspace-level MCP view (harness passthrough over the handler's shared connection manager) before the first session exists. * fix(tui): await workspace MCP readiness in the session-less /mcp list * fix(tui): hydrate the model default thinking effort for the session-less picker * style(tui): trim verbose comments in the lazy-default fixes * fix(tui): hydrate lazy defaults after login, serialize /new with lazy creation * fix(tui): re-check the busy gate after lazy /add-dir session creation * fix(tui): let Shift-Tab lazy-create the session on a v2 session-less start * fix(tui): hydrate session-less defaults on model-less login, refresh workspace commands on reload * fix(tui): re-check the idle-only gate for /new after waiting out lazy creation * fix(tui): wait out lazy creation before accepting model/effort switches * fix(tui): wait out lazy creation before switching sessions from the picker * fix(node-sdk): read session-less skills from the workspace skill catalog * feat(tui): show a session-less notice on v2 startup	2026-08-04 16:09:01 +08:00
github-actions[bot]	4ac7240fff	ci: release packages (#2469) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-04 15:11:04 +08:00
Haozhe	f412e105b3	feat(acp-server): bridge questions via elicitation and support host slash commands (#2583) ... * fix(acp): preserve cancels that arrive before the turn id is known A session/cancel landing between prompt submission and the launch round-trip found driver.turnId undefined and was dropped entirely; the turn then ran to completion and the prompt resolved end_turn despite the client's cancel. The engine's cancel payload makes turnId optional (an empty call cancels the active turn — the same contract kap-server's cancel route relies on), so cancel() now issues an unaddressed cancel in that window and flags the driver; the launch handler re-issues a precisely addressed cancel once the id lands, and a no-launch outcome settles cancelled instead of end_turn. * fix(agent-core-v2): shut session MCP overlays down on service teardown The ephemeral per-session MCP overlay was only shut down by the session handle's dispose wrapper, but the DI container disposes session scopes directly on workspace/app teardown, bypassing the wrapper — so overlays of sessions still live at shutdown leaked their MCP connections and stdio child processes. Track live overlays in the lifecycle service: the handle wrapper deletes-then-shuts-down (atomic, so close and service disposal can never double-shutdown), and the service's own dispose shuts down whatever is still tracked. * feat(acp-server): bridge questions via elicitation and support host slash commands - route AskUserQuestion through `elicitation/create` for form-capable clients (native multi-question + multi-select), falling back to the `request_permission` bridge on RPC failure - add a `slashCommands` resolver option so hosts can merge their own command palette and skill aliases into `available_commands_update`; `/help` now lists the merged palette - bridge `appendText`/`writeBytes` through client text capabilities (read-modify-write append, UTF-8-checked byte writes) with local filesystem fallbacks - defer `available_commands_update` until after the lifecycle response settles so clients like Zed do not drop the notification - propagate plan-toggle errors from `setMode` instead of silently reporting the new mode; make server `close()` idempotent * style(acp-server): satisfy oxlint eqeqeq and await-thenable rules * test(node-sdk): assert v1-v2 tokenCount parity for imports after eager counting	2026-08-04 10:44:56 +08:00
Haozhe	1328b32037	feat(acp): add experimental agent-core-v2 ACP server (kimi acp-v2) (#2571) ... * feat(acp): add agent-core-v2 ACP server - add ACP session lifecycle, configuration, permissions, and event bridging - expose the experimental kimi acp-v2 command with terminal authentication - add integration coverage and workspace build configuration * test: use neutral example domains in test fixtures and docs - replace placeholder hostnames (evil.com, foo.com, internal.corp, real.corp) with example.test / example.com in agent-core-v2 and kap-server tests - replace fixture emails (x@y.com, a@x.com) with example addresses in minidb tests and README * fix(acp): align acp-server with agent-core-v2 interfaces and address review - add missing appendText to AcpHostFileSystem (IHostFileSystem drift) - replace IAgentPromptService.prompt with inject - use Turn.cancel() instead of abortController - gate FS reverse-RPCs on client capabilities, fallback to local FS - return PROTOCOL_VERSION constant instead of echoing client version - remove misleading mcpCapabilities from initialize response - dispose old session wrapper before replacing on load/resume - fix object stringification lint error in convert.ts - add acp-v2 to expected CLI sub-command list in test * fix(acp): use enqueue for prompt submission, stop advertising unimplemented builtins - replace IAgentPromptService.inject with enqueue so onBeforeSubmitPrompt hooks (prompt-blocking policy) are not bypassed - stop advertising builtin slash commands (/help, /status, etc.) until builtin command execution is implemented - add comment explaining appendText stays local (ACP has no append RPC) - update skills test to match new availableCommands behavior * fix(acp): filter turn events by turnId, surface auth failures as auth_required - track turnId in driveTurn and ignore events from unrelated turns, preventing queued prompts from settling on the running turn - reject prompt requests with auth_required when turn fails with an auth-related error code, enabling ACP client re-auth flow * fix(acp): gate acp-v2 behind experimental flag, filter sessions by cwd - add acp-v2 experimental flag (KIMI_CODE_EXPERIMENTAL_ACP_V2) and gate CLI command registration behind it - filter session/list results by requested cwd instead of returning sessions from all workspaces - detect hook-blocked prompts via PromptHandle.state and add TODO for streaming block messages once the hook context exposes them * refactor(acp-server): rewire ACP server onto the klient facade - replace direct agent-core-v2 scope/service access (ISessionLifecycleService, ISessionIndex, IEventBus, ISessionInteractionService, etc.) with the Klient facade: klient.global.sessions / klient.session(id) / agent('main') handles - drive turns via agent.prompt() + session-level agent event subscriptions instead of per-prompt IEventBus wiring; settle on turn.ended - route approval/question bridging through session.interactions events - hide the thinking config option and skill catalog behind KLIENT-GAP markers until klient exposes those surfaces - acp-fs: pass realpath through to the local inner backend - klient: session.restore() rejects both null and undefined handles * feat(agent-core-v2): add session delete and ephemeral per-session MCP servers - add ISessionLifecycleService.delete: close a live session first, then remove its persisted data, evict the index read-model entry, and append a deleted tombstone to session_index.jsonl; unknown ids raise session.not_found - add CreateSessionOptions/ResumeSessionOptions.mcpServers: session-owned MCP overlay merged over the workspace manager via MergedMcpConnectionView (an ephemeral name shadows a workspace server), never persisted, released when the session scope tears down - return PromptLaunchResult from activateSkill so callers get the launched turn id and activation failures (unknown skill, busy) surface - add ISessionSkillCatalog.list() as a wire-friendly catalog snapshot - add ISessionIndex.remove for read-model eviction on delete * feat(klient): expose session delete, per-session MCP, skills, and stream events - session lifecycle contract: delete, resume/restore options, and CreateSessionOptions.mcpServers (ephemeral per-session MCP servers) - add the session skills contract and facade accessors for the wire-friendly skill catalog snapshot - register tool.call.delta, tool.progress, and compaction.* agent stream events so consumers can subscribe with typed payloads * feat(acp-server): align ACP v2 server with acp-adapter capabilities - complete the klient-facade rewire: ACP client connection holder and the terminal/* reverse-RPC runner routed through the Agent scope - negotiate the protocol version on initialize instead of pinning v1 - compress oversized prompt images at the ACP ingestion point with a format gate, caption, and persisted originals; a cancel arriving mid-compression settles the prompt as cancelled without a turn - stream tool call args via tool.call.delta (lazy pending create, cumulative replace, started upgrade) and refresh titles via tool.progress status updates - report compaction progress and results after /compact via the compaction.* events - answer unknown slash commands locally instead of sending them to the model - accept legacy "<id>,thinking" model ids and legacy approve / approve_for_session approval option ids - keep sessions without cwd metadata in cwd-filtered session/list - sanitize wire errors: auth codes map to auth_required, turn.agent_busy to invalid_request, everything else to a fixed internal-error message - bump @agentclientprotocol/sdk to ^1.3.0 * fix(cli): drop stale registerServerCommand call and sherif ACP SDK split - commands.ts called registerServerCommand, which no longer exists on current main (the deprecated `kimi server` shim is registered via registerWebCommand), breaking typecheck, build, and every CLI test that builds the program - sherif rejects the @agentclientprotocol/sdk major split between acp-adapter (^0.23.0, production kimi acp) and acp-server (^1.3.0, experimental); the two hosts legitimately target different SDK majors, so ignore the dependency in the sherif invocation * test: update fixtures for acp-v2 flag and domain rename, refresh nix deps hash - kap-server origin.test: two CORS cases still used foo.com after the whitelist moved to foo.example.com, so the origin was no longer whitelisted and the expected CORS headers were withheld - node-sdk config.test: expect the new acp-v2 experimental flag in the harness feature metadata - flake.nix: update the fetchPnpmDeps hash for the @agentclientprotocol/sdk 1.3.0 lockfile change * fix(acp): widen the ACP v2 auth gate beyond OAuth-only providers The gate consulted only auth.summarize(), which iterates providers declaring an oauth section — configurations that authenticate with a plain apiKey or provider env-bag credentials (no OAuth at all) were rejected with auth_required even though the default model is fully usable. - klient: expose authSummaryService.ensureReady on the global auth facade (the contract already declared it) - acp-server: gate on the engine's own readiness probe for the default model — config apiKey / env-bag / OAuth token all count, matching how the model is actually used — and fall back to "any logged-in OAuth provider" (the legacy adapter's first branch) - test: an apiKey-only config passes the gate with auth enforcement on; the OAuth logout regression is unchanged * fix(acp): reject concurrent prompts instead of displacing the in-flight turn A second session/prompt while a turn is running overwrote the session's only TurnDriver: the engine quietly queues plain prompts submitted during an active turn (the launch resolves undefined, indistinguishable from a hook-blocked launch), so the first prompt never settled and both turns' events went unattributed. Guard both model-bound launch paths (plain prompt and skill activation) with a synchronous in-flight check and reject with invalid_request (turn.agent_busy), matching the legacy adapter's busy semantics. Local slash handling (builtins, unknown-command answers) is unaffected.	2026-08-04 10:20:24 +08:00
Haozhe	21185447fe	feat(agent-core-v2): add tokenCounting service with strategy config and measured anchors (#2563) ... * feat(agent-core-v2): add tokenCounting service with strategy config and measured anchors - add IAgentTokenCountingService as the single owner of token counts: context size, full-request size, and estimate primitives, replacing the scattered contextSize/tokenEstimate/fullCompaction paths - add [token_counting] config section with strategy = measured+estimated (default) / measured / estimated, plus the KIMI_TOKEN_COUNTING_STRATEGY env override; measured zeroes all estimates, estimated ignores anchors - keep a live measured-anchor ledger in TokenCountingModel: each LLM exchange writes a real anchor, undo truncates the ledger so the surviving prefix restores its REAL measured size instead of a re-estimate, and compaction rebases to a single anchor that blends the compaction exchange's measured summary output tokens - skip writing an anchor when the stream reports no usage event instead of anchoring emptyUsage() zeros, which zeroed the context size and silenced compaction for providers without usage reporting - return the strategy-resolved size (not measured) from rpc getContext so the tokenCount contract stays correct under the estimated strategy - migrate all consumers (contextMemory, fullCompaction, llmRequester, rpc, mirrorAgentRun, sessionLegacy, kap-server legacyStatus, node-sdk, kimi-inspect) to the new service; edge bridges no longer read the wire model directly - document [token_counting] and KIMI_TOKEN_COUNTING_STRATEGY in the bilingual config reference * fix(kap-server): omit maxContextTokens instead of pushing 0 when unknown - readLegacyStatus falls back to the default model's context limit when no model is bound, and omits maxContextTokens entirely when the limit is unknown (0 is the engine's UNKNOWN_CAPABILITY marker, not a real limit) - profileService no longer emits maxContextTokens in agent.status.updated when the bound model alias does not resolve * fix(agent-core-v2): resolve token_counting strategy only at the reporting edge - keep measured anchors and heuristic estimates both recorded and feeding internal logic (compaction triggers, budgets, overflow backoff) regardless of the configured strategy - add IAgentTokenCountingService.statusSize() as the single strategy-resolved outward reading and route the WS/REST/RPC status surfaces through it - fix the context-size display falling back to provider-reported usage under the estimated strategy - fix compaction overflow backoff retrying identical messages until failure under the measured strategy (the strategy-gated estimator read as 0)	2026-08-04 09:44:21 +08:00
Haozhe	75395f6abb	feat(agent-core-v2): add lifecycle hook events and enrich hook payloads (#2558) ... * feat(agent-core-v2): add lifecycle hook events and enrich hook payloads New hook events: - TurnStarted: fired from the turn.started bus event, covering queued turns, stop-hook continuations, and background/system turns that UserPromptSubmit misses - UserPromptQueued: fired when a prompt cannot launch immediately, carrying the queue length - TaskStarted: fired from the existing task.started bus event, so background tasks no longer only produce a completion-time Notification - SessionHeartbeat: per-session 60s liveness beat, armed only when the event has hooks registered, letting hook consumers distinguish a session hanging on a long permission wait from a crashed one Payload enrichment: - client_type (host platform identity) on every event - session_title on every session/agent-scoped event - model and profile on SessionStart - SessionEnd reason is now 'exit' or 'archive' instead of a hardcoded 'exit' - SubagentStart/SubagentStop now carry session_id/cwd like every other event * fix(agent-core-v2): re-sync SessionHeartbeat timer on hook-index reloads The heartbeat timer was armed once after the runner's initial load, so a SessionHeartbeat hook contributed later by a plugin reload never produced beats for existing sessions. The runner now exposes onDidReload (fired after every index build), and the session adapter re-syncs on it: arming when a heartbeat hook appears, disarming when none remains. * fix(node-sdk): keep the v1 PluginInfo contract assignable with v2-only hook events The v2 hook-event union is now a superset of v1's, which broke the node-sdk type projection in two places: - the klient contract's hookDefSchema rejected plugin manifests using the new events (TurnStarted, UserPromptQueued, TaskStarted, SessionHeartbeat) at validation time — accept them - getPluginInfo returned the v2 PluginInfo where the SDK contract promises the v1 shape — project manifest.hooks through the v1-known event list (read from the legacy HookDefSchema), mirroring how the config mapper drops domains v1 does not know	2026-08-03 17:14:34 +08:00
Mangesh Raut	eaab2b6f28	fix(cli): fall back to built-in models.dev catalog when fetch fails (#2416) ... When the remote models.dev catalog cannot be fetched, fall back to the built-in catalog so CLI/TUI model selection keeps working offline or under network failure. Import the shared helper via the #/utils alias.	2026-07-31 19:54:09 +08:00
Haozhe	44d34bbd56	refactor(agent-core-v2): move host runtime args onto IBootstrapService (#2460) ... * fix(agent-core-v2): resolve package self-references in check-import-boundaries Imports spelled @moonshot-ai/agent-core-v2/<path> (the legal `./*` export self-reference) were treated as external packages, letting kosong layer violations through that spelling pass the checker. * refactor(agent-core-v2): move host runtime args onto IBootstrapService - Add HostArgs under BootstrapInput.args / IBootstrapService.args (agentFiles, skillDirs, requestHeaders, displayName, replyStyleGuide), mirroring VS Code's NativeParsedArgs on the environment service - Remove the narrow per-domain runtime-options services and their seed functions: IAgentCatalogRuntimeOptions, ISkillCatalogRuntimeOptions, IHostIdentity - Reduce IHostRequestHeaders to a pure kosong port contract and bridge it from bootstrap args via a new app/kosongConfig adapter, keeping kosong free of app-layer imports - Pass host args through bootstrap() at the composition roots (kap-server, v2 print CLI, node-sdk) instead of seeding services - Persist SDK provider removal as one atomic multi-section config replace * fix(config): persist provider refresh updates atomically - expose atomic multi-section config replacement through klient and SDK - stage provider removals before one atomic write in TUI refresh - briefly drain startup refresh during shutdown	2026-07-31 16:47:34 +08:00
liruifengv	32d693f644	feat(tui): ask for workspace trust on startup with the v2 engine (#2453) ... * feat(node-sdk): expose workspace trust state and trust grant on the v2 client * feat(tui): ask for workspace trust on startup with the v2 engine	2026-07-31 14:21:04 +08:00
Haozhe	ed7a4cc095	feat(kap-server): add session-less POST /workspace/fs:search route (#2437) ... * feat(kap-server): let fs:search resolve a workspace ref for draft sessions - fs:search accepts a workspace id or absolute root in the session_id slot so the @ file mention works before the session exists - kimi-web searchFiles falls back to the active workspace id in draft state * fix(agent-core-v2): report empty thinking level for unbound main agent - sessionLegacyService.status returns thinking_level '' when the main agent has no bound model (mirroring model: undefined), so clients fall back to the catalog default instead of folding in the wire model's 'off' zero value - add regression test for a never-bound main agent status - add web changesets: draft @ file mention, new-session thinking level * perf(minidb): make text index rebuilds async and non-blocking - TextIndex.build() yields to the event loop during tokenization and batches postings writes (~1 MiB), so large rebuilds no longer hard-block the host process - writes landing mid-build are queued and replayed onto the new base at swap time, keeping the rebuilt index exact - PostingsFile.rebuildSync renamed to async rebuild with a synchronous commit section (beforeRename hook + atomic rename) - onCompacted hook is now awaited (sync or async); open-time compaction runs in the background so open() returns without blocking on the snapshot rewrite and postings rebuild - compaction skips the postings rebuild when the index's write buffer is clean (needsRebuild) - createTextIndex registers before building so concurrent writes feed the build queue; dropTextIndex throws while a build is in flight * refactor(agent-core-v2): rename workspaceHandler to sessionLifecycle - rename IWorkspaceHandlerService to ISessionLifecycleService and move src/workspace/workspaceHandler/ to src/workspace/sessionLifecycle/; update all consumers (gateway, sessionExport, sessionLegacy, sessionLookup, kap-server, klient, node-sdk, kimi-inspect, kimi-code) - rename IStateService to IAppStateService and add the Workspace-scope IWorkspaceStateService, so the state domain spans all four scope tiers - add cascading StateRegistry.inspect(): each tier injects the parent tier's registry and folds App to current scope into one StateInspection tree; check-domain-layers gains a Rule 2b exemption for state-on-state imports * feat(kap-server): add session-less POST /workspace/fs:search route Carry the workspace reference (registered id or absolute root) in the request body and resolve it to the same Workspace-scope fs service the session route uses, so clients no longer borrow the session route's {session_id} slot. kimi-web's @ file mention now calls this route with the workspace ref instead of a session id; the session-route fallback stays for wire compatibility. * refactor(agent-core-v2): register workspace-scope service state into IWorkspaceStateService - move workspaceDirs / workspaceInstructions / workspaceSkillCatalog / workspaceTrust runtime state from bare instance fields into the workspace state container - extend gen-state-manifest.mts to scan app/workspace scopes, emitting AppStateSnapshot / WorkspaceStateSnapshot alongside Session/Agent - regenerate docs/state-manifest.d.ts and update AGENTS.md + agent-core-dev skill - update affected tests to register the state services and assert the new state keys	2026-07-31 12:11:26 +08:00
Haozhe	17dfd49768	feat(agent-core-v2): introduce the Workspace domain and the agent-profile registry extension point (#2366) ... * feat(agent-core-v2): insert Workspace lifecycle scope and remove mutable cwd paths - Insert LifecycleScope.Workspace between App and Session - Delete session/workspaceCommand domain (addAdditionalDir) and node-sdk RPC - Remove profile cwd mutation; cwd is fixed at creation - Make ISessionWorkspaceContext read-only; seed additionalDirs at creation - Remove TUI and vscode /add-dir commands (to return workspace-scoped) * feat(agent-core-v2): add Workspace scope with handler-owned session lifecycle - Add IWorkspaceLifecycleService (App scope): handler registry, create-or-get handlerFor with inflight join - Add workspace/workspaceContext seed and workspace/workspaceHandler (session create/resume/fork as handler child scopes) - Delete App-level ISessionLifecycleService; callers compose index -> handlerFor -> handler via sessionLookup helpers - Slim IBootstrapService; persistence addressing via handler chain (disk layout byte-identical) - kap-server routes rewire internally; /api/v1 wire unchanged, debug surface gains workspace addressing - Pin red line in domain lint: session/agent must not import workspace domains * feat(agent-core-v2): collect workspace resources into the handler scope - Add Workspace-scope catalogs for skills and agent profiles, instructions service, and a shared MCP connection manager (built at materialization, refreshed by watch/plugin events) - Session catalogs keep their APIs but read seeded snapshots and refresh via change events; ISessionMcpService removed - Session create options carry no mcpServers; MCP sources are config file (wins on name conflicts) and plugins only - Agent profile/mcp consume the seeded providers * feat(agent-core-v2): restore add-dir as a workspace-level capability - Add workspace/workspaceDirs: shared additional-dir set with addDir({path, persist}); persist=true writes .kimi-code/local.toml, local.toml watch drives cross-process refresh - ISessionWorkspaceContext becomes a live read view fed by the ISessionWorkspaceInfo seed contract and change events - Restore Session.addAdditionalDir in kimi-code-sdk 1:1, mapping to the workspace service; restore TUI/vscode /add-dir verbatim * feat(agent-core-v2): collect os-level services into the workspace scope - Move fs service, fs watch (shared subscription fan-out), process runner, and a git facade to Workspace scope; sessionFs domain removed - Add IWorkspaceToolPolicy with workspace veto wired through tool activation, execution guard, composed evaluation, and profile prompt projection; injected via ISessionToolPolicyGate seed - kap-server fs routes and fs.watch bridge remap to the workspace services; wire unchanged * refactor(agent-core-v2): clean up workspace-domain leftovers and docs - Drop dead code: v2 mergeCallerMcpServers, the transitional ISessionContext.additionalDirs field, an unreachable guard - Fix stale domain references in comments; correct test names - Give the fs-watch refresh test a realistic wait budget under load - Document the four-scope model and workspace domain in AGENTS.md, agent-core-v2 docs, and the agent-core-dev skill * test(node-sdk): wait for the initial MCP connect to settle in the parity list test v1 connects in the background after create resolves while v2 awaits it inside create, so an immediate list can catch either side still pending under CI load * refactor(agent-core-v2): extract git work-tree discovery into the git domain - add the pure findGitWorkTree probe in app/git/workTree and expose it as IGitService.findWorkTree - switch the git permission policies off the local findLocalGitWorkTreeMarker helper to the DI service - reuse findGitWorkTree for AGENTS.md project-root discovery in agent/profile/context.ts - add findWorkTree coverage to gitService.test.ts * feat(kimi-inspect): add Workspace Services view - add WorkspaceServicesView rail view with a workspace picker on top; proxies resolve workspace-scope Services on the /workspace/:id route - extend ChannelScope, ServiceTarget, and ServicePanelDef scope with 'workspace', routed via client.workspace(id).service - wire the new view into NavRail and App * refactor(agent-core-v2): extract mcpCore and workspaceMcpConfig domains - move the scope-agnostic MCP connection layer (stdio/http/sse clients, connection manager, oauth, config schema, tool naming) from agent/mcp to the new mcpCore domain - move the [mcp] config section to app/mcpConfig and OAuth credential persistence to app/mcpConfig/oauthStore - introduce the workspace/workspaceMcpConfig domain owning the effective MCP server set (mcp.json files + plugin contributions, refreshed by fs watch); workspaceMcp keeps pure connection orchestration - update the plugin domain, session MCP handle, klient/node-sdk contracts, and tests accordingly * refactor(agent-core-v2): remove the fault-injection experimental feature - delete the faultInjection domain (flag definition, IFaultInjectionService contract, FaultInjectionService implementation) - drop the requester-side take() injection point and the constructor dependency from llmRequester - remove the flag-gated test cases and the IFlagService stub they needed - regenerate the state manifest without the faultInjection state keys * feat(agent-core-v2): gate project-level MCP config behind workspace trust Add the Workspace-scope IWorkspaceTrust service: an explicit, per-workspace trust marker persisted under the home (IAtomicDocumentStore, keyed by encodeWorkDirKey(root)) so a checked-out tree cannot pre-trust itself. While a workspace is untrusted, workspaceMcpConfig skips the project-level .mcp.json and .kimi-code/mcp.json files (user-level config and plugin contributions still load); a trust flip reuses the reload path, so project servers connect on trust and disconnect on untrust. Expose the state over kap-server REST: GET /workspaces/{id}/trust, POST /workspaces/{id}/trust, POST /workspaces/{id}/untrust. * feat(kimi-inspect): replace the workspace picker with a directory browser The Workspace Services view now keeps a server-side directory browser in a left sidebar (over IHostFolderBrowser) instead of a <select> of registered workspaces. Entries that are registered workspaces carry a workspace badge plus their IWorkspaceTrust trust state; selecting an unregistered folder registers it on demand via IWorkspaceService.createOrTouch. * fix(agent-core-v2): resolve the effective cwd into the profile binding A default-bound agent recorded no cwd in its profile.bind payload, and no caller configures ProfileServiceOptions.cwd, so the profile service's cwd getter fell through to '' and refreshSystemPrompt() rebuilt the prompt from the server process's cwd: an AGENTS.md edit dropped the workspace instructions (or swapped in unrelated ones). bind() now persists the resolved effective cwd (the input's, or the session's when the input omits it) into profile.bind — the Model's cwd stays creation-fixed and is always set. The getter's last resort is the session's own cwd (the value legacy bindings resolved against) instead of a bare ''. * refactor(agent-core-v2): introduce the contribution/registry/catalog extension point for agent profiles - App-scope IAgentProfileRegistry: any scope can register an AgentProfileContribution keyed by (sourceId, workspaceKey); dedup per source id, change events drive catalog re-projection - workspaceAgentProfileLoader domain owns agent-file discovery end to end (parse / roots / SYSTEM.md / explicit runtime files) with five Workspace-scope loaders (workspace / user / plugin / extra / explicit) tagged with the handler's workspaceId; internals live under internal/ - SessionAgentProfileCatalog projects the registry directly (name dedup, priority adjudication, builtin override rule, inspect()); the workspace-catalog + sessionData seed relay is gone - builtin code contributions register as the 'builtin' entry via BuiltinAgentProfileLoader; plugin agent roots are provided by the plugin domain as PluginAgentRoot - remove cwd from the profile binding chain (BindAgentInput / ProfileBindingSnapshot / AgentConfigData / ProfileModelState / profile.bind op) — it is always the session's frozen cwd; legacy wire.jsonl records replay fine (the schema strips the field) - share markdown frontmatter parsing via _base/text/frontmatter * fix(agent-core-v2): reconcile the workspace refactor with main - restore the branch's klient workspaceId scope extension lost to a file-level conflict resolution (main had no further changes there) - stub the plugin system-prompt dependencies main added to the profile service in the profileOps / skillCatalog tests - correct PLUGIN_SKILL_SOURCE_ID to the App skillSource domain (Agent scope must not import the Workspace domain) - kap-server workspaceLayout test supplies the now-required hostIdentity - regenerate wire/state/config manifests * fix(agent-core-v2): export the agent-file parse primitives the v2 print CLI consumes The internal/ split kept parseAgentFileText / resolveAgentPath off the package entry, but apps/kimi-code's v2 print runner imports them from @moonshot-ai/agent-core-v2 for --agent-file. Export the two symbols by name; everything else under internal/ stays domain-private. * feat(agent-core-v2): return cwd listing for empty fs:search query An empty fs:search query used to fail request validation (query had a minimum length of 1), so @-mention pickers had no starting set right after typing "@". The workspace fs service now answers an empty query with the workspace root's top-level entries — directories first, hidden entries excluded, gitignore and exclude_globs honored — mapped into the search-hit shape (score 1, empty match positions) and capped by limit. The mirrored protocol wire schema is relaxed in sync. * test: cover cron-fired steer context and titled session creation - agent-core-v2: e2e asserting a cron-fired steer turn carries earlier tool results (the CronCreate job id) into the provider request - klient: conformance case creating a titled session through implicit workspace materialization	2026-07-31 00:38:11 +08:00
github-actions[bot]	bc28e9d802	ci: release packages (#2342) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-30 14:56:30 +08:00
Haozhe	d36f4c58f6	refactor(agent-core-v2): remove the fault-injection experimental feature (#2399) ... - delete the faultInjection domain (IFaultInjectionService, its Agent-scope implementation, and the fault-injection experimental flag) - drop the llmRequester's per-attempt fault consumption point and the faultToError helper - remove the fault-injection test cases and DI wiring from the requester service tests, and the domain's layer-registry entry - regenerate the state manifest without the faultInjection.* state keys	2026-07-30 14:45:31 +08:00
liruifengv	40172c7ca9	feat: unify the host identity across OAuth, telemetry, and kap-server (#2382) ... * refactor(oauth): make X-Msh-Platform an explicit host identity field X-Msh-Platform was hardcoded to kimi_code_cli in createKimiDeviceHeaders, so non-CLI hosts could not state their own platform and the desktop had to patch the header after the fact. KimiHostIdentity now carries a required platform (every host declares its own value; the CLI constant stays the fallback only for direct createKimiDeviceHeaders callers), and userAgentProduct is renamed to productName so the transport identity uses one name everywhere. All in-repo identity constructions pass platform explicitly; the wire value for CLI and VS Code hosts is unchanged (kimi_code_cli). * feat(agent-core-v2): carry the host identity in the bootstrap snapshot Replace the flat clientVersion field with a required clientIdentity (KimiHostIdentity) so every consumer reads the same host identity object: OAuthToolkitService now passes it to the OAuth toolkit, which means the OAuth device-flow endpoints (device authorization, token polling, refresh) on the kap-server path finally send the full X-Msh-* device headers instead of none, and the telemetry cloud appender reads client_version from the same source. A built-in CLI fallback keeps bare bootstrap() calls in tests working; composition roots must pass their own identity. The session export manifest grows an optional desktopVersion field (payload plumbed through; filled by kap-server in a follow-up). * feat(agent-core): thread the host identity into the managed auth facades The v1 managed auth facade constructed its OAuth toolkit without an identity, so token refreshes from inside the core went out without any X-Msh-* device headers. createManagedAuthFacade now takes an optional KimiHostIdentity and every call site supplies one: CoreProcessService._defaultOAuthTokenResolver forwards the core process's options.identity (the same source _defaultKimiRequestHeaders uses), and the DI-held services (oauth / auth summary / model catalog) read it from a new optional identity field on IEnvironmentService. The library-level "no identity, no device headers" contract is unchanged. * feat(kap-server)!: require the host identity and derive request headers from it ServerStartOptions.hostIdentity is now a required ServerHostIdentity (KimiHostIdentity + optional prompt display fields), replacing both the old optional HostIdentityOverrides (renamed to PromptIdentityOverrides, its productName field now displayName) and the version option (renamed to serverVersion — it is the engine version reported as server_version, while the host product version travels in hostIdentity.version). The server now feeds bootstrap's clientIdentity from hostIdentity and derives the default outbound headers (User-Agent + X-Msh-*) from it via createKimiDefaultHeaders, so kap-server-hosted OAuth flows and model / WebSearch requests carry the real host identity instead of a hardcoded kimi-code-cli fallback UA. Explicit header seeds still win as an escape hatch. Session export manifests record the host product version: kimiCodeVersion now carries hostIdentity.version (the engine version no longer appears), and desktop exports (desktop: true) are additionally stamped with a desktopVersion field. The instance registry keeps its host_version wire field for compatibility (kimi-inspect reads it); only the in-memory name changed to serverVersion. * feat(cli): wire the CLI host identity into the kimi web server kimi web now passes createKimiCodeHostIdentity(version) as the server's hostIdentity, so web-UI OAuth flows and the engine's outbound requests carry the explicit CLI identity (productName + version + platform). The explicit hostRequestHeadersSeed is dropped — kap-server derives the same headers from hostIdentity — and buildKimiDefaultHeaders goes away with its only consumer. * test(klient): drop clientVersion from the bootstrap contract parity list * chore: add changesets for the host identity unification * feat(cli): tag kimi web requests with a (web) User-Agent suffix kimi web shares the CLI product token and platform, so its outbound requests were indistinguishable from direct CLI runs upstream. Its host identity now carries userAgentSuffix 'web', putting web-UI traffic at kimi-code-cli/<version> (web) while X-Msh-Platform stays kimi_code_cli. * fix(klient): keep the env() clientVersion wire field after the bootstrap identity switch The bootstrap snapshot replaced the flat clientVersion scalar with clientIdentity, which broke klient's env() fan-out (RPCError: method not found). The wire surface keeps clientVersion — now sourced from clientIdentity.version — and bootstrapService gains a clientIdentity read (registered in envContract with an object schema) for consumers that want the full identity. * feat(oauth): send the product User-Agent on OAuth requests The OAuth endpoints used to receive only the X-Msh-* device headers (undici's default UA otherwise), which left the OAuth host unable to distinguish runtime surfaces — notably kimi web, whose platform matches the CLI and whose only distinguishing mark is the (web) UA suffix. The toolkit now feeds the full identity headers (User-Agent + X-Msh-*) into every device authorization, token polling, and refresh request; the request-header type widens from DeviceHeaders to OAuthRequestHeaders. * feat(vscode): report kimi_code_vscode as the extension's platform The VS Code extension inherited the CLI's hardcoded X-Msh-Platform value; with platform now an explicit identity field it declares its own, so the managed endpoints and OAuth host can tell extension traffic apart from CLI runs. * refactor(agent-core-v2)!: require the client identity at the composition root The bootstrap fallback identity fabricated a kimi-code-cli/unknown host for any caller that forgot to pass one — the same silent-misreport pattern this series set out to remove, and it made "required" a lie. BootstrapInput.clientIdentity is now required, so a missing identity fails at compile time instead of being papered over. Test and example callers pass a shared fixture (klient examples and test engines get one each); the node-sdk v2 client asserts its host identity with the oauth helper. Also folds DeviceHeaders from an interface into a type alias so it stays assignable to the widened OAuthRequestHeaders record. * feat(oauth)!: require and validate the platform in device headers Drops the quiet CLI fallback in createKimiDeviceHeaders (the same silent-misreport pattern removed from the bootstrap identity): platform is now a required option, validated with the same required-ASCII rule as the version — empty or all-non-ASCII values throw instead of emitting a blank X-Msh-Platform, and header-unsafe characters are stripped rather than sent raw. * fix(node-sdk): seed the host request headers on the v2 client path The interactive v2 engine path (experimental flag) bootstrapped without a hostRequestHeaders seed, so managed vendor calls went out with the SDK's default User-Agent (OpenAI/JS) and no X-Msh-* at all — v1 passes the full identity headers on the same requests. The v2 client now seeds the headers from its asserted host identity, and a test pins the seed. * chore: simplify the CLI changeset wording	2026-07-30 13:45:41 +08:00
7Sageer	b850c5f8f5	fix(node-sdk): wire applyPersistedSecondaryModel to agent-core-v2 (#2345) ... * test(node-sdk): drop v1-only subagentNames from the resume parity projection Custom agent files made v1's resumed agent config carry the bound profile's delegatable subagent roster; v2's resumed agent state has no equivalent field, so the resume parity cases fail on main. Project the engine-owned field away instead of pinning it as a resume-data gap. * fix(node-sdk): wire applyPersistedSecondaryModel to agent-core-v2 On the v2 engine route the /secondary_model command persisted the recipe but failed to apply it to the current session: the SDK method fell through to the base class's not_implemented getRpc(). v1 pushes a reloaded config snapshot into the session because its spawn binding, tool descriptions, and cached startup warning all read that snapshot. agent-core-v2 resolves the secondary model live against IConfigService at spawn time and rebuilds the tool description per read, so the setConfig write already takes effect session-wide. The override keeps the rest of v1's contract: config reload, the same loud validations (session lookup, persist-first recipe check, pointed-model resolution wrapped at [secondary_model].model), and a warning-cache refresh via a new recheckSecondaryModelWarning on the session warning service. getSessionWarnings also surfaces the v2 secondary-model warning next to the AGENTS.md one, matching v1's aggregate. * fix(agent-core-v2): surface the subagent's bound model on status events The v2 model slice rides only the bind-time agent.status.updated, which precedes subagent.spawned and is dropped by clients that key child events off the spawn, so subagent cards never learned the model — and a single-step run emits no usage/context slice until it ends, so the model only appeared at completion. Re-affirm the binding right after the spawn announcement via a new IAgentProfileService.republishStatus, and fold a consistent usage/context/model snapshot into every status event at both v1 edges (kap-server's broadcaster and the in-process SDK session wiring, resolving the secondary-model derived id to a readable display name. EOF ) * Delete .changeset/subagent-card-model.md Signed-off-by: 7Sageer <sag77r@hotmail.com> * style(agent-core-v2): remove inline implementation comments --------- Signed-off-by: 7Sageer <sag77r@hotmail.com>	2026-07-29 15:40:42 +08:00
7Sageer	efac96c8a9	feat(agent-core): custom agent files and secondary model on the v1 engine (#2232) ... * feat(agent-core): custom agent files and secondary model on the v1 engine Migrate the custom agentfile and secondary-model capabilities from agent-core-v2 to the v1 engine so they work in the TUI and plain kimi -p sessions: - discover Markdown agent files from user/project/extra/explicit directories with the v2 precedence rules, a merged session profile catalog replacing the hardcoded builtin profile lookups, SYSTEM.md main prompt override, and ${base_prompt} backed by the effective default - --agent/--agent-file now work in print mode on the default engine; CreateSessionOptions gains agentProfile/agentFiles - [secondary_model] config + KIMI_SECONDARY_MODEL/EFFORT bind newly spawned subagents to a cheaper model behind the secondary-model experiment flag, with primary/secondary model params on Agent and AgentSwarm and upfront session warnings - full disallowedTools deny semantics (exact names + mcp__ globs) evaluated by the tool manager and persisted in the agent wire * fix(cli): guard optional agentFiles in the prompt runner runPrompt is also driven programmatically (headless goal flow) with options that never pass through the CLI parser defaults, so agentFiles can be undefined; mirror the addDirs optional-chaining pattern. Also extend the SDK experimental-feature assertion with the secondary-model flag. * fix(agent-core): preserve custom agent bindings on v1 * fix(agent-core): narrow secondary model error hints * fix(agent-core): persist custom agent profile bindings * Delete .changeset/sdk-agent-profile-options.md Signed-off-by: 7Sageer <sag77r@hotmail.com> * Update v1-custom-agent-files.md Signed-off-by: 7Sageer <sag77r@hotmail.com> * Update v1-secondary-model.md Signed-off-by: 7Sageer <sag77r@hotmail.com> * Update v1-custom-agent-files.md Signed-off-by: 7Sageer <sag77r@hotmail.com> * fix(agent-core): keep SYSTEM.md a prompt-only overlay for delegation * docs: update agent file and secondary model availability wording * fix(cli): reject --agent-file combined with session resume The resume path only forwards the agent file's name for the bound-profile assertion; the file's content is never re-applied (the session keeps its creation-time catalog snapshot). Previously the combination was silently accepted, so an edited file (or a same-named one) appeared to apply but did not. Reject it at option validation and document the constraint. * refactor(agent-core): share prompt-section prose and note v2 twins in agentfile headers The Windows notes, additional-dirs and skills prose blocks existed twice: inline in the builtin default template (system.md) and as constants in the agent-file renderer (from-file.ts). Extract them to profile/prompt-sections.ts as the single source: system.md renders them through injected KIMI_* template variables and from-file.ts imports the same constants. Rendered prompts are byte-identical for all four builtin profiles across macOS/Windows and skills/dirs on/off; a new test pins system.md to the shared constants. Also mark each profile/agentfile file with the path of its agent-core-v2 counterpart so format/semantics changes land in both engines. * feat(cli): add /secondary_model command for the subagent model Mirror /model: a picker with a thinking-effort step that persists [secondary_model] and live-applies to the current session via a new Session.setSecondaryModel RPC (node-sdk wrapper included), so newly spawned subagents bind the new model right away. The /model picker now hides the synthesized __secondary__ derived entry; docs and the update-config builtin skill mention the section. * feat(tui): show the bound model in subagent run stats Subagents report their model alias via agent.status.updated after spawn; resolve it to a display name and surface it in tool-call subagent stats and agent-group rows. * fix(agent-core): validate agent profile before session persistence * fix(agent-core): refresh subagent tools after model switch * fix(agent-core): show subagent model preferences * fix(agent-core): preserve secondary model recipe on live apply * fix(agent-core): make secondary model apply explicit * fix(tui): refresh secondary model display state * chore: merge secondary model changesets into one * Add /secondary_model command for subagent configuration Show each subagent's model in the subagent card header and agent-group rows. Requires the secondary-model experiment (KIMI_CODE_EXPERIMENTAL_SECONDARY_MODEL=1); run /secondary_model to pick a model and thinking effort, applied to the current session immediately. Signed-off-by: 7Sageer <sag77r@hotmail.com> * fix(agent-core): align explicit agent file precedence * fix(agent-core): let disallowedTools deny select_tools * chore(cli): drop engine mention from --agent/--agent-file help text * feat(cli): support --agent/--agent-file in the interactive TUI Bind the selected agent profile to the startup session when launching the TUI with --agent/--agent-file, including the session created after an OAuth login at startup. Sessions created later in the process (/new) keep the default profile. Make both flags creation-only in every mode: combining them with --session/--continue is now rejected in print mode too, since resume restores the bound agent from the session automatically. * fix(agent-core): persist new secondary-model selections under env overrides stripSecondaryModelConfig restored secondary_model.model/default_effort from raw whenever KIMI_SECONDARY_MODEL/KIMI_SECONDARY_EFFORT was set, so a /secondary_model pick made under the env vars was silently discarded on write. Restore from raw only when the value being written still equals the env value (an overlay round-trip), mirroring the pointer check in stripEnvModelConfig; a genuinely different selection now reaches config.toml. * fix(cli): report the effective secondary model when env overrides the pick /secondary_model toasted the picked alias even when KIMI_SECONDARY_MODEL/KIMI_SECONDARY_EFFORT made the session bind a different model. Read the effective binding back from the reloaded config (as /model does from session status) and warn with the env-overridden values instead. * feat(tui): show the bound model name in the AgentSwarm panel header --------- Signed-off-by: 7Sageer <sag77r@hotmail.com>	2026-07-29 12:06:26 +08:00
Haozhe	f79fde2b90	feat(node-sdk): migrate the SDK method surface to agent-core-v2 (#2262) ... * feat(node-sdk): add agent-core-v2 backed SDKRpcClientV2 harness - add SDKRpcClientV2 wiring the v2 engine (DI x Scope) in-process via the klient memory transport, with getExperimentalFeatures migrated to klient.global.flags.list() and unmigrated methods failing fast - export createKimiHarnessV2 / SDKRpcClientV2 from the SDK index - wire the experimental v2 gate into the CLI interactive shell (run-shell) - extend build-dts to bundle agent-core-v2 and klient declarations * feat(node-sdk): migrate listWorkspaceSkills to agent-core-v2 - add engineAccessor escape hatch exposing the in-process engine's app-scope service accessor for SDK methods the klient facade does not cover yet - implement listWorkspaceSkills via ISkillDiscovery plus the v2 user/project root helpers and BUILTIN_SKILLS (plugin skills and skillDirs still gaps) - add a v1-v2 parity test pinning identical return values per migrated method, with understood gaps listed explicitly in KNOWN_DIFFS * feat(node-sdk): migrate the SDK method surface to agent-core-v2 - implement the remaining SDKRpcClientBase methods on SDKRpcClientV2, routed through the klient facade where covered, the engineAccessor escape hatch where the engine has a service, or SDK-side rebuilds on v2 primitives where only primitives exist (config shape mapping, global mcp.json store, MCP OAuth flows, importContext, session warnings, print background policy) - translate the v2 event stream into the v1 Event union and bridge approval/question/user_tool interactions per live session - rebuild resume replay by folding the v2 wire.jsonl through the v1 agent restore pipeline, so resumed sessions render history again - keep deleteSession as not_implemented; the v2 engine has no delete capability - extend the v1-v2 parity suite to every migrated method, pinning understood engine differences in KNOWN_DIFFS - add the dev:cli:v2 root script to launch the TUI on the v2 engine * fix(node-sdk): await the v2 undo and compaction-cancel agent calls * test(cli): spread the real oauth module in the telemetry test mock * feat(node-sdk): forward v2 engine telemetry to the host telemetry client * feat(cli): gate the v2 TUI route behind a dedicated KIMI_CODE_TUI_V2 switch * fix(node-sdk): honor skillDirs on the agent-core-v2 SDK route The v2 SDK client accepted KimiHarnessOptions.skillDirs (the CLI's --skills-dir) but never seeded it into the engine, so explicit skill dirs were silently dropped on the v2 TUI route and the Skill tool could not find skills from them. Seed skillCatalogRuntimeOptions at bootstrap and let listWorkspaceSkills resolve the explicit dirs as the user source, matching the engine's session skill catalog. * refactor(cli): gate the v2 TUI route behind the master experimental flag again Drop the dedicated KIMI_CODE_TUI_V2 switch: the TUI v2 harness route is gated by KIMI_CODE_EXPERIMENTAL_FLAG, the same master switch as the kimi -p v2 route. The gate tests are kept with updated assertions, and dev:cli:v2 sets the master flag again.	2026-07-28 20:29:45 +08:00
liruifengv	b0f43aea28	feat(oauth): return structured managed usage rows (#2300) ... * feat(oauth): return structured managed usage rows Stop formatting plan-usage labels and reset hints into English strings at the oauth layer. The parser still absorbs backend field drift, but now emits a stable structured row (name / window{duration,unit} / used / limit / resetAt) that kap-server passes through and clients localize themselves: - window: normalized from duration/timeUnit (minute/hour/day/week), whole-hour minute windows fold to hours, unnamed summaries are the weekly limit - resetAt: absolute ISO timestamp; relative reset_in/ttl seconds are converted at parse time - TUI /usage panel formats labels and reset hints locally * refactor(oauth): parse managed usage strictly to the current payload shape Drop the defensive drift tolerance (alternate reset-time spellings, reset_in/ttl seconds, remaining-derived used, title/scope names, top-level duration/timeUnit, fuzzy time-unit matching) and parse only what the platform actually sends: numeric strings, resetTime, nested detail/window records, TIME_UNIT_* enums. * fix(node-sdk): update managed usage smoke example and facade tests for structured rows	2026-07-28 15:03:25 +08:00
github-actions[bot]	8bf5bacba9	ci: release packages (#1989) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-22 17:24:39 +08:00
Kai	ec88d352e8	fix: five correctness follow-ups to the catalog metadata work (#2030) ... * fix: five correctness follow-ups to the catalog metadata work - Normalize a configured effort value (case/whitespace) before thinking resolution on both engines, so "OFF" is read as off instead of being sent upstream as an invalid effort. - Clamp a declared input cap to the effective context window in the effective model resolution, so an override lowering max_context_size cannot leave a stale larger cap behind. - Report context usage against the same effective cap (max_input_tokens ?? max_context_tokens) in the SDK getStatus and the v2 legacy status projections, matching the session-event and service surfaces. - Preserve concretely declared per-model endpoints when the override npm is unrecognized, via the same OpenAI-compatible fallback used for top-level entries. - Attribute resolved.maxInputSize and resolved.capabilities .max_input_tokens in the model inspector to their config, override, or clamp provenance. * fix: honor observed context caps and publish the effective cap in v2 status - The overflow-learned provider window is now written into both max_context_tokens and max_input_tokens of the effective compaction context, so the strategy cannot bypass it by re-selecting the raw catalog input cap during overflow recovery. - agent.status.updated publishes max_input_tokens ?? max_context_tokens, matching the other v1/v2 status surfaces. * fix: never mutate config on clamp, cap usage ratio, and refuse proprietary override SDKs - effectiveModelAlias / effectiveModelConfig now build a copy before clamping maxInputSize to the effective window instead of rewriting the caller's config record in place. - context_usage is clamped to 1 in the v2 legacy status, the v1 session service, and the SDK getStatus; the default-model status fallback also resolves the input cap. - Overrides naming known proprietary SDKs (Bedrock, Cohere) are refused before the OpenAI-compatible fallback, matching top-level import behavior. - The inspector attributes a clamped maxInputSize to the clamp even when the raw value came from models.*.overrides. * fix: normalize forced efforts, prefer input cap in WS status, keep raw event ratio - Whitespace-only configured efforts now read as absent, and the KIMI_MODEL_THINKING_EFFORT override is lowercased on both engines. - kap-server's WS legacy status publishes max_input_tokens ?? max_context_tokens like the other status surfaces. - SDK getStatus keeps the ratio unclamped on purpose (>100% is the documented overflow signal on that path); schema-bounded REST status stays clamped to 1. - Pin the provider-observed window beating a declared input cap with a v1 full-compaction regression test. * fix: attribute resolved.maxInputSize provenance and drop test-body comments in v2	2026-07-22 03:13:10 +08:00
Kai	b5efba7abc	fix: consume the model metadata declared by the models.dev catalog (#2015) ... * fix: stop advertising Claude thinking efforts for non-Claude models Models served over the Anthropic protocol whose names carry no Claude marker (e.g. a catalog-imported Kimi K3) no longer inherit the latest Opus effort list, so the model selector stops offering levels the model does not accept. The models.dev catalog import now also parses reasoning_options and records the declared effort levels on the model alias, so K3 offers its real levels (low / high / max). * fix: consume deprecated, override, and input-limit metadata from the models.dev catalog - Models declared status=deprecated in the catalog are no longer offered for import. - Per-model provider overrides on gateway providers (an npm package targeting an Anthropic SDK plus a usable endpoint) now land as alias protocol and base_url, so those models are served over the right protocol and endpoint; overrides without a usable URL are skipped. - A declared limit.input now sizes the context budget instead of the larger total context window (e.g. gpt-5: 272k instead of 400k). The model alias schema gains an optional base_url field (not accepted in overrides) that Anthropic wire resolution prefers over the provider-level base URL. * fix: honor thinking-disable semantics and the OpenAI-compatible fallback in catalog imports - reasoning_options 'none' is the model's off encoding: off_effort flows from the catalog through the model alias to the OpenAI wire providers, so turning thinking off sends 'none' instead of omitting the effort field; models with effort levels but no way to disable thinking are imported as always_thinking and no longer offer an Off option. - Bare Claude family aliases (e.g. sonnet-latest) recover the inferred Anthropic effort profile; v2 comment conventions restored. - Providers whose SDK the catalog does not type now fall back to the OpenAI-compatible wire (with a visible "guessed" note) instead of being refused; imports lacking a usable endpoint ask for one (--base-url on the CLI, a prompt in the TUI). Proprietary SDKs (Amazon Bedrock), unrecognized explicit types, and env-placeholder URLs are refused with a clear reason. * fix: align catalog imports with the reference models.dev consumer - A JSON null tier in declared effort values is now read as the 'none' off-encoding (previously such models were wrongly imported as always-thinking with no way to turn reasoning off). - Alpha-status models are filtered out alongside deprecated ones. - Models whose per-model provider override targets a wire that cannot be expressed per-model (e.g. Claude on google-vertex, whose wire here is Gemini-mode Vertex, or gpt entries on an Anthropic provider) are skipped instead of being imported under the silently wrong protocol. - interleaved: true no longer pins reasoning_content: the provider's default three-field scan is wider and the pinned key only narrowed reasoning parsing for gateways answering with another field name. * fix: require endpoints for Anthropic-compatible catalog imports and honor --base-url - catalogProviderNeedsBaseUrl now covers the Anthropic wire: a non-official Anthropic-compatible vendor without a concrete catalog endpoint (e.g. google-vertex-anthropic) must supply --base-url / the TUI prompt instead of silently falling back to the default Anthropic endpoint. - --base-url now takes precedence over the catalog-declared endpoint, and an empty --base-url is rejected instead of persisting a blank endpoint. * fix: enforce always-on thinking on every wire and refuse Cohere at import A model that declares always_thinking (e.g. a catalog-imported gpt-5) no longer resolves to a dishonest off state via thinking.enabled=false or an SDK/ACP off request: resolution clamps to the model's default effort on every wire instead of letting upstream keep reasoning while the UI reports Off. The Anthropic warn-and-send path for unlisted effort levels is unchanged. Cohere's proprietary SDK joins Amazon Bedrock on the import-refusal list instead of being guessed as OpenAI-compatible. * fix: harden catalog import edge cases - An explicit but unrecognized catalog type is now refused before npm/id inference, so a future catalog protocol is never silently miswired through the OpenAI fallback. - User-supplied --base-url values for Anthropic-wire providers get the same trailing-/v1 normalization as catalog endpoints, avoiding /v1/v1/messages requests. - The TUI import prompt rejects env-placeholder base URLs like the CLI does. * fix: await the floating assertion promise in the catalog add CLI test * refactor: unify catalog import resolution into a single decision function Wire-type inference, the OpenAI-compatible fallback, proprietary-SDK refusal, endpoint adaptation, and the base-URL requirement are now produced together by resolveCatalogImport, one pure resolver consumed by both the CLI and the TUI — replacing the cooperating predicates (inferWireType, isGuessedWireType, catalogProviderNeedsBaseUrl) whose permutations kept producing edge cases. No behavior change. * fix: close configured-off clamp hole, keep inferWireType compat, carry same-wire override endpoints - A configured thinking.effort = "off" no longer bypasses the always-on clamp: it is treated as absent and the model default applies, mirrored on both engines. - The previously public inferWireType stays as a deprecated compatibility wrapper over resolveCatalogImport so existing SDK consumers do not break on a patch release. - Catalog model overrides that stay on the provider's wire but declare their own endpoint now persist it on the alias (and the v1 OpenAI wire branches honor alias-level base URLs like the Anthropic branch). * fix: split total window from input cap and close override/endpoint gaps - max_context_tokens once again means the total context window (used by completion budgeting); a model's declared input limit is tracked as max_input_tokens, which compaction, context-splice and usage-ratio checks prefer — fixing the over-clamping introduced when the input cap was stored as the context budget. - A catalog endpoint declared only as an env placeholder now always produces needs-base-url (official SDK included), so credentials are never sent to the public vendor host by default. - api-only per-model overrides are honored as same-wire endpoint changes; overrides targeting another known but inexpressible wire (e.g. google-genai on an OpenAI gateway) are skipped; same-wire models whose declared endpoint is an unusable placeholder are skipped instead of silently rerouted. * style: drop a function-level comment from the v2 thinking resolver * chore: consolidate the PR's changesets into two user-facing entries	2026-07-22 01:23:31 +08:00
liruifengv	e45832398d	fix(tui): keep long sessions responsive and bound resumed history (#1976) ... * fix(pi-tui): reuse processed lines across frames in the renderer Each frame previously re-truncated, re-normalized, and re-compared every transcript line, so steady-state frames (spinner ticks, streaming flushes) cost O(total lines x chars) and pegged one core in long sessions. Keep the previous frame's raw lines, processed output, and per-line kitty image ids; a line whose raw string reference is unchanged reuses its processed output verbatim, and image-id consumers read the cache instead of re-scanning text. * fix(tui): stop tree-wide transcript invalidation on structural updates Grouping a second Read/Agent call, removing swarm progress, finalizing an MCP status row, replay tool-call removal, and /undo each invalidated the entire transcript tree, forcing every mounted message to re-render (markdown lexing + code highlighting) on the next frame. The container's render cache already validates per child by reference, so structural child-list changes are picked up without a tree-wide invalidate; reserve it for global style changes such as theme switches. * fix(tui): fold older assistant messages into the turn step summary Step merging only collapsed thinking/tool steps, so assistant text blocks accumulated without bound inside a turn (hundreds of markdown components in a single long turn, all re-processed every frame). A running turn now keeps its last 20 assistant messages (KIMI_CODE_TUI_KEEP_RECENT_ASSISTANT), and a finished turn folds down to its conclusion tail of 2 (KIMI_CODE_TUI_KEEP_RECENT_ASSISTANT_COMPLETED); older ones collapse into the step summary line with a message count. Entries are kept, so expand behavior is unchanged. * fix(session): bound resumed history to the most recent user turns Resume used to return every agent's full replay over the RPC boundary (a long session can reach ~100MB, serialized and parsed several times on an in-process call), while the TUI only renders the last 10 user turns. The resume payload now accepts an optional replayTurnLimit, the turn-boundary predicate moves into agent-core as the single source of truth (limitAgentReplayByTurns, re-exported through the SDK), and the CLI passes its existing 10-turn limit so resume transfers just the tail. * fix(session): count goal continuation rounds as replay turns Replay turn boundaries only matched real user input, so a 100-round goal (a handful of user prompts plus 100 system-trigger continuations) fell entirely inside the 10-turn replay window and resumed by rendering the whole run from the start. The goal driver already fires one synthetic prompt per goal turn and counts those as turns itself, so replay trimming now treats goal_continuation prompts as turn boundaries and keeps the most recent 10 rounds. The continuation prompt is model-facing and hidden live; replay no longer renders it as a user bubble either, while still advancing the replay turn so each round groups separately. * fix(tui): keep replay turn folding when goal continuations are hidden Suppressing goal continuation bubbles removed every turn-boundary component from goal-session replays, so mergeAllTurnSteps found no turn edges and skipped step/assistant folding entirely — a single oversized goal round still mounted all of its tool cards and assistant messages. Mount an invisible ReplayTurnBoundaryComponent for each hidden continuation: it renders zero lines but keeps the turn edges discoverable to folding and window trimming, matching replay trimming's per-round turn semantics. * chore: consolidate and simplify changesets	2026-07-21 15:20:12 +08:00
7Sageer	ce0e3ceb04	feat: support custom agent files (#1735) ... * feat: support custom agent files Discover Markdown+frontmatter agent definitions from user, project, and configured directories; merge them into a session-level profile catalog (priority: builtin < user < extra < project < explicit). Custom agents work as subagents via the Agent tool and as the main agent. - agent-core-v2: new agentFileCatalog domain (discovery/parsing/profile factory, mirroring skillRoots/parseFrontmatter) and sessionAgentProfileCatalog merged view; AgentProfile.tools becomes optional (undefined = all tools) and gains disallowedTools deny list, evaluated in profileService.isToolActive and persisted in session wire records so resume keeps the gate even if the file is gone - CLI: restore --agent/--agent-file for the v2 print runner (KIMI_CODE_EXPERIMENTAL_FLAG); the v1 TUI rejects them with a clear v2-only error - kap-server/protocol: optional profile field on prompt submission with first-bind semantics (same-name no-op, different name rejected) - docs: custom agents section (en/zh) + config/CLI references + changeset * chore: shorten custom agents changeset * fix(agent-core-v2): stringify caught errors in agent catalog log calls * docs: drop v2 engine notes from custom agents docs * fix: align custom agent binding semantics across engine and edges - agent-core-v2: bind now owns the first-bind invariant — switching profiles after bind throws profile.already_bound (checked again in the synchronous segment before the first wire dispatch, so concurrent binds cannot both pass); unknown names throw profile.unknown; same-name rebinds keep the persisted thinking effort. - kap-server / CLI: edges degrade to error mapping / same-name no-op instead of their own divergent guards. - agent files: reject non-string mode values, honor disallowedTools in the append-mode Skill probe, pass --agent-file through unresolved so the engine can expand ~, reject empty --agent-file values. - session catalog: ready is recoverable via reload() after a fatal source failure, and agent-file discovery is kicked at session materialize so resumed sessions see file agents from the first turn. - docs: first-bind semantics, name: agent override, tools: [] meaning, --agent-file last-wins. * fix: tighten custom agent behavior * fix: address custom agent review findings * fix(agent-core,agent-core-v2): keep active-tool wire records replayable by v1 Binding a profile without a tool allowlist (the default for file-defined custom agents) persisted a tools.set_active_tools record with no `names` key. v1 clients discover v2 sessions through the shared session index and replay newer wire versions without migration, so the record crashed v1 resume with a TypeError and wedged the session permanently. The v2 engine no longer writes the record when the base set is already "every tool active" (its absence encodes the same state), and v1 replay now skips records that lack `names` as defense in depth for wires already written by preview builds. A same-name rebind that resets an allowlist to "all tools" has no v1-safe encoding and is left as a documented gap (no production caller today); a future tools.reset_active_tools Op is safe because v1 silently no-ops unknown record types. * fix(agent-core-v2): tolerate unreadable directories in agent-file discovery A single unreadable subdirectory (EACCES anywhere in the scanned tree) previously aborted the whole discovery pass, zeroing every agent of that source on every session start with one path-less warning. The walker now skips-and-warns per directory below the root (mirroring the skill discovery it parallels), root-level failures are isolated per root so one bad root no longer takes its siblings down, and only a genuinely transient whole-fs outage (os.fs.unavailable) still propagates so the session catalog keeps its previous contribution. Source-level warnings now name the offending path, and repeated skip warnings are capped with a summary that samples the suppressed paths. Also consolidates the path primitives (~ expansion, base-relative resolution, realpath type probes) shared by the root resolvers, the walker, and the explicit-file source into agentFileCatalog/paths.ts, and tightens parser diagnostics: frontmatter null is treated as absent, and a present-but-wrong-typed name/description reports a type error instead of "missing". * fix(agent-core-v2): warn when a same-name builtin suppresses a file profile A directory-discovered agent file colliding with a builtin profile without override: true was silently dropped at merge time. The suppression now logs a warning naming the profile and the opt-in. * refactor(agent-core-v2): pass skillActive explicitly to renderSystemPrompt The third parameter was a full tool list used only for includes('Skill'), which forced the agent-file profile factory to answer a boolean question with sentinel lists. The template now takes an explicit skillActive flag; a skillActiveFor helper keeps builtin call sites derived from their tool arrays. * refactor(agent-core-v2): fall back to the configured default model in bind BindAgentInput.model is now optional: the engine resolves a missing model against the configured defaultModel and throws model.not_configured when neither is set, so edges no longer each re-implement the fallback. * fix(agent-core-v2,kap-server): reject unsupported thinking atomically at first bind A REST prompt carrying profile + an unsupported thinking effort bound the session first and failed setThinking after, wedging the session on an identity the user never successfully used. The effort is now validated up front when the caller marks it as an explicit request (strictThinking): the bind rejects before any await or state mutation, and the requested effort rides along in the bind instead of a separate setThinking. Internal spawn/fork paths pass inherited thinking without the flag and keep the previous clamp behavior — a persisted effort that drifted out of the model's support list must not break subagent spawning. The route's now-redundant model fallback is dropped in favor of the engine-side default. * fix(agent-core-v2): await the agent profile catalog at session materialize The catalog's ready promise was only kicked, so a resumed session's first turn could render the Agent tool description without the file-defined agent types. Discovery is local-fs and cheap, so materialize now awaits it; ready only rejects for a fatal explicit-source error, which is exactly the case that should fail fast. A failure there now also removes and disposes the half-materialized handle instead of leaving it registered in the session cache. * test: cover the --agent-file fatal path and tidy profile registration hygiene The v2 print CLI now has a test asserting an invalid --agent-file fails before any turn. The denylist profiles in binding.test.ts register in a beforeAll (idempotent, scoped to the describe's run window) instead of at module scope during collection. * docs: align custom agent docs with v2-engine gating --agent/--agent-file are rejected without the v2 engine, so restore the requirement in the Agents and Command Reference pages (and use KIMI_CODE_EXPERIMENTAL_FLAG=1 in the examples), note that tool lists only shape model-visible disclosure (permission rules are the enforcement layer), and remind authors of delegation-bound agents to state the handoff contract in the prompt body. * test(agent-core-v2): revert unrelated style churn in fs/workspace tests Keep these files' diff limited to the realpath fakes the feature needs; the lint-preference rewrites belong to a separate cleanup. * feat(agent-core-v2): add permanent system prompt override via SYSTEM.md Read $KIMI_CODE_HOME/SYSTEM.md on every startup and inject it as the default main-agent profile (name "agent", override: true), replacing the builtin default system prompt while inheriting builtin tools and description. Missing or empty files are ignored; unreadable files warn and fall back to the builtin profile. The body supports variable substitution (${skills}, ${agents_md}, ${cwd}, ${cwd_listing}, ${os}, ${shell}, ${now}); unknown variables pass through verbatim. Priority: --agent-file / --agent / project override > SYSTEM.md > same-name user-scope scan files. * feat(agent-core-v2): gate tools globally and accept session disabledTools Add a [tools] config section: "enabled" acts as a global allowlist (empty = unconstrained), "disabled" as a denylist applied on top, both intersected with the active profile's policy in isToolActive (mcp glob supported). Plumb a session-persistent disabledTools parameter through the stack: v2 RPC PromptPayload, REST "disabled_tools" (protocol and kap-server parallel schemas), klient contract/facade, and node-sdk. The server applies it via profileService.setSessionDisabledTools, which replaces the client-owned denylist, keeps the profile's own deny, persists across resume, and rejects calls before a profile is bound with profile.not_bound (mapped to 40001). v1 core-api gains a type-only field and ignores it. * fix: enforce session tool policy across agents * fix(agent-core-v2): enforce tool policy at execution * fix(agent-core-v2): align subagent tool descriptions with policy * fix(agent-core-v2): harden custom agent policy state * fix(agent-core-v2): harden custom agent lifecycle * refactor(agent-core-v2): persist profile binding in a single profile.bind record * fix(agent-core-v2): skip unreadable paths during agent file discovery * fix(agent-core-v2): exempt select_tools from the executor policy guard - share one composed profile/global/session tool-policy evaluation between the executor gate and prompt rendering instead of two verbatim copies - tolerate context-build failure in system prompt refresh instead of rejecting callers (config watcher void-fire, session policy fan-out) * test(agent-core-v2): resolve profile and tool-policy SUTs by interface - drop the Object.assign patching of tool-policy methods onto the shared profile service; rename describes so the SUT ownership is accurate - classify profile.bind as v2-only with the accepted v1-replay tradeoff documented, un-red the wire vocabulary guard test - cover the select_tools guard exemption with an executor-level test * fix(agent-core-v2): enforce explicit select_tools policy * feat(agent-core-v2): accept Claude-style tool lists and rename agent-file mode to promptMode * feat(agent-core-v2): unify prompt templating on ${var} - Replace the nunjucks renderer with a single ${var} regex renderer (unknown placeholders pass through verbatim) and drop nunjucks from agent-core-v2. - Merge the variable tables into one catalog shared by the builtin system.md, SYSTEM.md, and agent file bodies; adds additional_dirs_info plus code-composed blocks (windows_notes, additional_dirs_section, skills_section). - Replace the agent-file promptMode field with ${base_prompt}: bodies are always rendered as templates, and ${base_prompt} expands to the effective default profile prompt (honoring the SYSTEM.md override). - Migrate the builtin system.md, goal reminders, compaction instruction, and tool description templates to the same syntax. * docs: complete agent priority chain and link SYSTEM.md precedence * test: fix invalid custom agent fixture * fix(cli): reject multiple agent selectors * feat(agent-core-v2): add subagents allowlist to agent files * fix(agent-core-v2): persist the subagent allowlist in the profile binding The delegation allowlist now rides the profile.bind record like the tool denylist, so a resumed session keeps enforcing it even when the source agent file was deleted or changed. Agent/AgentSwarm resolve the caller's allowlist from the persisted binding data instead of looking the profile up in the live catalog. * feat(agent-core-v2): warn on tool patterns that never match Profile bind/apply and [tools] config changes now statically flag entries that can never activate anything — wildcards without the mcp__ prefix (a bare * in an allowlist disables everything, in a denylist nothing), incomplete mcp__ literals, and names no registered or builtin-profile tool has — via a tool-pattern-no-match warning event, once per pattern, instead of letting the tool set silently shrink. The known-name vocabulary is the live registry plus literal names from the builtin profiles, so flag-gated tools stay known and a typo in one agent file cannot legitimize the same typo in another. * docs: align --agent-file docs with the single-selector CLI The flag accepts exactly one file and conflicts with --agent, but the docs still described the earlier repeatable, composable design. * docs: note the agent-file trust model and never-matching tool patterns Spell out that project-scoped agent files can replace the default main agent's whole system prompt (unlike AGENTS.md reference injection), and list the three tool-pattern shapes that never match and now raise a warning. * chore: slim changeset wording to user-facing language Drop wire record names, enforcement mechanics, and template syntax from the entries; split the v1 resume fix into its own patch changeset; add a patch entry for the tool-pattern warnings. * chore: shorten changeset entries to one-line summaries * Delete .changeset/v1-resume-v2-sessions.md Signed-off-by: 7Sageer <12210216@mail.sustech.edu.cn> * test: drop class-instance spread in sessionLifecycle test stub * chore: clear the comments --------- Signed-off-by: 7Sageer <12210216@mail.sustech.edu.cn>	2026-07-21 15:01:43 +08:00
Haozhe	5ae60fa673	feat(transcript): add unified transcript layer, drop the /api/v2 RPC surface (#1888) ... * feat(transcript): add unified transcript layer and v1 surface - add packages/transcript: agent-granular L1 store, idempotent L2 ops, off/turn/block/delta L3 granularity, L4 view registry, and turn-cursor pagination; sole owner of all transcript wire types - kap-server: engine-event-driven TranscriptService with history backfill, GET /sessions/{id}/transcript, and transcript.ops WS deltas with per-connection granularity control - kimi-inspect: render ChatView from the transcript surface (REST pages + delta-only WS) instead of context memory - sync flake.nix workspace lists and document packages/transcript and packages/server-e2e in AGENTS.md * fix(transcript): project live prompts and anchor backfilled items - agent-core-v2: carry the extracted prompt text on turn.started so the transcript projector can render the user input at turn open (the context append with the same text is not a bus event and lands later) - kap-server: keep the prompt through turn.ended; anchor backfilled markers/taskrefs to their following snapshot turn so replaying history after live turns arrived keeps the historical order - transcript: add an optional beforeTurn placement anchor to marker.upsert / taskref.upsert; anchored inserts land before the first turn at or past the anchor instead of appending blindly Addresses review feedback on #1888. * fix(transcript): adopt backfilled stream frames and group goal turns - kap-server: on mid-stream attach, adopt the backfill-seeded stream frame (id + offset) instead of opening an empty one whose upsert clobbered the seeded text and whose offset-0 appends could not land - transcript: group a turn-opening system_trigger (goal continuation) into its own turn so cold rebuilds keep the turn boundary and stay ordinal-aligned with the engine's live turn numbering Addresses review feedback on #1888. * fix(transcript): drop stale live stores on close and heal after turns - drop a session's live transcript store when the session closes or archives (lifecycle events plus a re-check on the cached-entry path) so reads fall back to the cold rebuild instead of serving a stale store - re-read an ended turn from the persisted wire records (debounced per agent) and merge it back live-first: headers keep live state/timestamps while origin/prompt recover from disk, and truncated text/thinking frames from a mid-turn attach are restored only when the persisted text is longer — a fresh live frame or a lagging flush is never reverted Addresses review feedback on #1888. * fix(transcript): adopt seeded tool frames and route subagent questions - kap-server: adopt the backfill-seeded tool frame when a tool.result arrives for a call that started before the projector attached, so the output lands instead of being dropped (the producer-store lookups now ride one projector options object) - agent-core-v2: record the owning agent on question interactions (ISessionQuestionService.request gains an agentId option, passed by AskUserQuestionTool from its agent scope) so a subagent's questions route to its own transcript and WS events instead of 'main' Addresses review feedback on #1888. * fix(transcript): adopt parent frames, namespace live markers, redact resets - kap-server: fall back to store adoption when subagent.spawned links a parent tool call that started before the projector attached, so the agentRefs link is not lost on mid-bind attaches - kap-server: id live markers in their own namespace (live-mN) — the cold rebuild numbers its markers m1... too, and a colliding id made the store's upsert replace the historical marker instead of appending - transcript/kap-server: redact transcript.reset snapshots to the subscriber's grade (below 'block' the step/frame detail is stripped), so a 'turn'-grade subscription no longer receives full content on resets Addresses review feedback on #1888. * fix(transcript): fold blocked turns into failed, drop inline v2 comment - kap-server: map turn.ended reason 'blocked' to the 'failed' transcript state, matching the engine's TurnEndReason wire contract and the v1 mapTurnReason folding (it was presented as a user cancellation) - agent-core-v2: move the question agentId rationale into the ask-user file header — package rules keep comments in the top-of-file block only Addresses review feedback on #1888. * fix(transcript): keep roster descriptors and resolved-event agents - kap-server: keep the metadata-seeded roster descriptor (parentAgentId / label) when an on-demand history backfill lands its roster entry, instead of downgrading it to { agentId, type } - kap-server: remember each interaction's owning agent and stamp it on the resolved question/approval v1 events — they were hard-coded to 'main', so an agent-filtered subscriber saw a subagent's question open but never close Addresses review feedback on #1888. * fix(transcript): defer pending seeding, skip ghost roster entries - kap-server: announce interactions pending at bind time only after the initial backfill (new TranscriptBinding.seedPendingInteractions), and adopt the seeded tool frame on the request/resolve paths, so a pre-existing approval lands next to its backfilled tool call and keeps the approvalId back-link - kap-server: skip the roster entry when a probed agent id has neither a roster presence nor persisted content (agent_id=nope no longer conjures a ghost subagent) - agent-core-v2: fold the turnEvents import rationale into the loop file header (package rule: comments live in the top-of-file block only) Addresses review feedback on #1888. * fix(transcript): reject hostile agent ids, honor the agent allowlist - transcript/kap-server: validate agent ids as plain names (no separators, no dot segments) at the REST query layer and again before the id is joined into the wire-records path — an authenticated client could otherwise read a wire.jsonl outside the agents directory - kap-server: compose the legacy v1 agent allowlist with transcript grades on every fan-out path (initial resets, per-ops fan-out, roster-driven resets), so a filtered connection no longer receives other agents' transcript frames Addresses review feedback on #1888. * fix(transcript): settle foreground shell tasks on shell.completed - agent-core-v2: emit a transient shell.completed event when a foreground `!` command settles (detached runs keep reporting through the task lifecycle) — the generic task.terminated never fires for foreground tasks, so their transcript cards were stuck at 'running' - kap-server: map shell.completed to the terminal transcript task state (completed/failed) and classify the event as volatile on both v1 durability gates, like its shell.* siblings Addresses review feedback on #1888. * fix(transcript): replay early resolves, reset on a widened filter - kap-server: register bind-time pending interactions without frames so a resolve arriving before the post-backfill seed still routes, then replay it at seed time — request and resolve land together with the approvalId back-link, instead of the interaction vanishing entirely - kap-server: treat an agent newly admitted by a broadened legacy agent filter as owed a transcript.reset even when its grade transition is a no-op (delta → delta) — its ops were suppressed so far, so it has no baseline otherwise Addresses review feedback on #1888. * fix(transcript): keep materialized transcripts on agent disposal - kap-server: only the projector dies with the agent scope — the materialized transcript and roster entry now survive disposal (the roster mirrors session metadata, which keeps completed agents). Dropping them lost already-served history for good: the backfill cache dedupes per agent, so the next read rebuilt an empty shell instead of replaying the persisted records Addresses review feedback on #1888. * fix(transcript): anchor refreshes by oldest turn, group slash turns - kimi-inspect: re-cover the previously loaded window after a refresh by paging until the previous OLDEST turn is loaded again (extracted as recoverLoadedWindow) — a count-based stop silently dropped the window's head once new turns shifted the server window - transcript: group user-slash skill/plugin activations into their own turn (marker included), mirroring the engine's isRealUserPrompt — their assistant output no longer folds into the previous turn on cold rebuilds; other triggers stay marker-only Addresses review feedback on #1888. * fix(transcript): compare all tool fields, overlay in-flight backfills - transcript: include toolCallId/name/view/input in the tool frame equality check — an upsert correcting only those was dropped as a no-op, leaving stale tool metadata on clients - kap-server: overlay the loop's active turn as 'running' after a backfill (cold grouping marks every rebuilt turn completed, so a live turn showed as finished until it ended); snapshot data supplies origin/prompt, and a projector-owned running header is never downgraded Addresses review feedback on #1888. * fix(transcript): gate ops before the seed, re-assert running headers - kap-server: gate the transcript ops fan-out (and roster-driven resets) on a per-connection seeded flag set only after the baseline reset has landed — a subscriber joining mid-stream no longer receives deltas against an empty baseline - kap-server: always re-assert the loop's active turn as 'running' after the snapshot ops in a backfill (skipping the overlay when a live running header existed let the snapshot's cold 'completed' header downgrade it); live header fields win over the snapshot's Addresses review feedback on #1888. * docs(agent-core-v2): fold turnEvents notes into the file header Move the turn.started prompt rationale from field/function TSDoc into the module header — package rules keep comments in the top-of-file block only. Addresses review feedback on #1888. * fix(transcript): emit shell failure output, dispose per-agent listeners - agent-core-v2: emit the synthesized failure text as a final shell.output chunk before shell.completed (it was never streamed, so failed foreground commands showed empty output in transcript tasks until a full rebuild) - kap-server: track each agent's bus subscription per agent and dispose it in onDidDispose — the listener captures the projector, so a disposed agent no longer keeps projecting late events into the store Addresses review feedback on #1888. * fix(transcript): route shell events by task id, tidy question docs - agent-core-v2: keep the commandId → foreground-task-id mapping and carry taskId on shell.output / shell.completed, so consumers attaching mid-command (having missed shell.started) can still route output and the terminal state - kap-server: fall back to the event's taskId in the shell output/completed projectors and seed the shell task before the first chunk, so output is preserved and the terminal upsert cannot clobber it with an empty tail - agent-core-v2: fold the question agentId note into the question.ts file header (package rule: comments live in the top-of-file block only) Addresses review feedback on #1888. * fix(transcript): tighten agent id validation, match kinds in heals - transcript: constrain agent ids to a filename-safe shape ([A-Za-z0-9._-], <=128 chars) — NUL-containing or overlong ids made the wire-records read throw unhandled errors (500) instead of failing validation - kap-server: require the live frame's kind to match before the post-turn heal's length shortcut — a kind-mismatched frame (the projector guessed the stream kind wrong mid-turn) is now replaced by the persisted one instead of being skipped Addresses review feedback on #1888. * fix(transcript): heal missed tool results, seed pendings per agent - kap-server: re-emit tool frames in the post-turn heal when the live step lacks the frame or the live frame lacks the outcome the persisted one carries (a tool.result dropped in the attach race is otherwise unrecoverable); live-only extras (display / agentRefs / approvalId) are preserved, and frames with a live outcome stay untouched - kap-server: scope seedPendingInteractions by agent — the initial seed after backfillMain covers main-owned pendings, and each subagent's pendings seed after its own on-demand backfill, so placement and the approvalId back-link find the persisted tool frames Addresses review feedback on #1888. * fix(protocol): register shell.completed on the v1 event surface - packages/protocol: add ShellCompletedEvent (plus optional taskId on shell.output / shell.completed and prompt on turn.started) to the event interfaces, zod schemas, the agent event union, and the volatile list — schema-validating consumers previously rejected the forwarded shell.completed frames outright - kap-server: mirror the same fields in the v1 events-zod module Addresses review feedback on #1888. * test(node-sdk): cover shell.completed in the exhaustive event switch The SDK's session-event type test asserts exhaustiveness with assertNever; register the new event there (CI typecheck caught it). Addresses review feedback on #1888. * fix(transcript): source cold-session rosters from session metadata - kap-server: add TranscriptService.readColdRoster (persisted state.json → descriptors, mapped like the live seeding) and use it for the cold transcript path — the requested agent id is only appended when it has content (or is main), so an empty probe (agent_id=nope) no longer fabricates a ghost roster entry, matching the live path Addresses review feedback on #1888. * fix(transcript): emit taskrefs when seeding missed shell commands - kap-server: the mid-command-attach seeding in onShellOutput now emits the matching taskref.upsert (exactly like onShellStarted), and onShellCompleted emits one when the whole command was missed — the task no longer exists only in the global map with no timeline item to render Addresses review feedback on #1888. * fix(transcript): defer unseeded live pendings, keep cold tools running - kap-server: pendings created before their owning agent's seed has run now defer into the same unseeded queue as bind-time ones (tracked per agent) — announcing them during the backfill window misplaced them into a synthetic step with no later repair - transcript: cold grouping initializes tool frames as 'running' and lets the tool-message branch transition them to done/error — an approval- gated or still-executing tool no longer shows as completed on rebuilds Addresses review feedback on #1888. * fix(transcript): seed live-created agents, merge backfills live-first - kap-server: agents created after binding are marked seeded immediately — their projector covers every event from creation on, so their pendings announce without waiting for an explicit history read (which previously left live subagent approvals/questions stuck in the unseeded queue) - kap-server: the initial backfill merges turns live-first via healTurnOps (snapshotToOps gains a turn-mapper parameter) — live frame fields landed during the disk read (display/approvalId, longer text) are no longer replaced by the staler persisted version Addresses review feedback on #1888. * fix(transcript): count pages in turn segments, not head units - transcript: the leading non-turn unit no longer consumes a turn slot — pages are counted in turn segments and the head unit rides only with the page reaching the first turn. A timeline with a head marker and exactly pageSize turns used to drop the marker from the newest page and hallucinate an older marker-only page (has_more: true with no older turns) Addresses review feedback on #1888. * fix(transcript): send baseline resets after cursor replay - kap-server: broadcaster.subscribe gains deferTranscriptReset (recording prev grades/filter per target) plus flushTranscriptSeed; the v1 connection defers the transcript baseline on cursor-carrying (re)subscribes and flushes it after replay — a reconnecting client no longer sees the reset's current seq ahead of the replayed lower-seq backlog Addresses review feedback on #1888. * fix(transcript): gate the ops fan-out only when a reset is coming - kap-server: willSendTranscriptReset decides upfront whether any reset will be sent (grade upgrade or widened legacy filter); a same-grades resubscribe no longer un-seeds the target, so ops emitted mid-resubscribe keep flowing instead of being silently dropped by the fan-out gate Addresses review feedback on #1888. * fix(transcript): seed subscribers even when no reset is owed - kap-server: a no-reset subscription (e.g. a client subscribing to a fresh session with an empty roster) now still marks the target seeded after subscribeTranscript completes — roster resets and ops would otherwise stay gated forever once agents appear Addresses review feedback on #1888. * fix(transcript): guard mismatched appends, expose prompt via klient - transcript: appendAtOffset now treats an overlapping chunk whose head does not match the local tail as a gap (diverged stream) instead of silently rewriting from the offset and dropping local content - klient: add the optional prompt field to the turn.started event schema so SDK listeners receive it instead of zod stripping it Addresses review feedback on #1888. * fix(transcript): open turns for subagent run prompts in cold grouping - transcript: add the subagent system trigger to the turn-opening set — a subagent's run prompt (persisted as system_trigger/'subagent') always launches a new engine turn, so resumed subagent histories no longer fold the response into the previous turn or lose the prompt Addresses review feedback on #1888. * fix(transcript): guard bus subscriptions independently of projectors - kap-server: subscribeAgent now guards on a dedicated subscribedAgents set instead of projector existence — a projector seeded before its agent's handle exists (e.g. during an on-demand backfill) no longer blocks the bus subscription, so the agent's live events keep flowing Addresses review feedback on #1888. * fix(kimi-inspect): reconcile the transcript on every socket open - apps/kimi-inspect: TranscriptWs now reports onReconnected on the FIRST successful open too, not only on re-established ones — ops emitted between the REST page load and the subscription (a delayed or failed first connection) were previously lost onto a stale store; the consumer's refresh guard drops the no-op call while the initial load is in flight Addresses review feedback on #1888. * fix(transcript): derive the active step, dedupe tool error rendering - kap-server: the projector gains a stepOrdinal lookup backed by the engine's activity view (resolved lazily through the agent lifecycle), so deltas after a late attach at step >= 2 land in the real active step instead of a synthesized t<N>.1 - apps/kimi-inspect: render a tool frame's error only when it differs from its output — onToolResult sets both to the same string for failed tools, which drew the failure twice in red Addresses review feedback on #1888. * fix(kimi-inspect): reconcile the transcript on the subscribe ack - apps/kimi-inspect: TranscriptWs now fires onReconnected when the subscribe ack for its client_hello arrives instead of at socket open — the server attaches the transcript stream only after processing client_hello, so a refresh fired at open could finish before the subscription was active and still miss the ops in between Addresses review feedback on #1888. * fix(kimi-inspect): coalesce concurrent transcript refreshes instead of dropping A subscribe ack landing while the initial REST load was still in flight hit the `if (refreshing) return` guard, so ops emitted between the REST page snapshot and the WS subscribe were neither in the page nor delivered over the socket. Replace the drop guard with a coalesced runner: at most one refresh in flight, and triggers during a run are collapsed into exactly one follow-up run after it settles. * fix(kap-server): force the transcript baseline after cursor-based replay A cursor re-subscribe at unchanged grades deferred its baseline and then compared against the previous grades on flush, so no reset was sent — while volatile ops fanned out during the deferral had been dropped, leaving the client with a permanent gap. flushTranscriptSeed now always seeds a full baseline (previous grades no longer tracked in the deferred record), and a regression test covers the same-grade cursor resubscribe. Also drop the inline comments added to shellCommandService.ts — the agent-core-v2 convention keeps commentary in the top-of-file block; the context moved there. * fix(kap-server): harden transcript seeding against stale and wildcard subs Two subscribeTranscript gaps found in review: - Re-read the target's subscription after the history awaits: subscribe work runs asynchronously, so an overlapping downgrade/unsubscribe used to be answered with resets computed from the stale spec. The reset loop now uses the latest grades/filter from state.targets and bails when the target is gone or no longer graded. - Backfill roster agents admitted via the wildcard grade, not just explicitly named ones: a historical subagent seeded into the roster from session metadata had no materialized AgentTranscript, so wildcard subscribers silently never received its baseline reset. Adds regression tests for the wildcard backfill, the mid-seed downgrade, and the mid-seed unsubscribe (all three fail without the fix); makeCore now accepts persisted agent metadata for roster seeding. * fix(transcript): let meta.merge clear mode badges on mode exit `agent.status.updated` with `planMode: false` / `swarmMode: false` was dropped by the transcript projector because `meta.merge` could only set mode badges, never clear them — clients kept rendering an exited mode until the next full reset. The merge wire shape now accepts `null` per mode key (set = object, clear = null, absent = keep): the reducer deletes the key and normalizes an empty `modes` away, the zod schema validates the nullable form, and the projector emits the clearing op for exit events. * fix(agent-core-v2): keep system-turn steering text out of turn prompts `turn.started.prompt` was populated from the turn input for every origin, so system-triggered turns (goal continuation, subagent run, cron) exposed their internal steering text to live transcript consumers; the cold rebuild mirrored the same leak when grouping persisted history. The loop now populates the prompt only for displayable user origins (user input, or a user-slash skill/plugin activation) via the new isDisplayablePromptOrigin gate, and the cold grouping opens hidden-origin turns promptless. Turns still open normally — only the prompt text is withheld. * fix(kap-server): reattach the transcript fan-out after a session reload When the engine session closed or archived, TranscriptService dropped the live store together with its ops listener set, but the broadcaster's SessionState kept its transcriptStream — so ensureTranscriptStream returned early for a later subscribe on the resumed session, delivering a fresh reset but never the live transcript.ops. The stream is now pinned to its TranscriptStore instance and the fan-out re-registers whenever a rebuilt store shows up. Adds a regression test that drops the service entry mid-stream and asserts ops keep flowing after resubscribe (fails without the fix). * fix(transcript): map legacy background_task origins in cold rebuilds Legacy/v1 sessions persist background-task notifications with origin.kind === 'background_task' (the live mapper already handles that spelling), but the cold grouping only mapped 'task' — after a restart those turns fell through to { kind: 'other' } and lost their taskId, so the transcript could no longer associate the notification turn with its background task. Both spellings now share the task-origin branch. * fix(kap-server): project no-taskId shell failures into the transcript A foreground `!` command that failed before onForegroundTaskStart ran (Bash validation/spawn/registerTask errors) published shell.output / shell.completed with taskId undefined, and the projector's guard dropped them — the live transcript lost the stderr and the terminal state of a command that did run. Shell events now resolve their task as the id learned at shell.started, else the event's own taskId, else a synthetic per-command id (shell-<commandId>), so early failures land like any other shell task. * refactor: drop the /api/v2 RPC surface and the klient http transport - kap-server: remove the /api/v2 REST routes and /api/v2/ws socket (registerRpcRoutes renamed to serviceDispatcherRoutes; transport/ws/{eventMap,registerWs,wsClient,wsConnection,wsProtocol} deleted). /api/v1/debug/* is now the only RPC surface — a reflection dispatcher over the entire scoped DI registry with no whitelist — and /api/v1/ws the only WS endpoint - klient: drop the http transport (transports/http/*, transports/ws/wsSocket.ts) and the kap-server devDependency; transports reduce to the ipc|memory subpath entries, and the dual/v2 e2e suites go with them - kimi-inspect: target /api/v1/debug only with no fallback, replace the Service-event push channel (wsChannel/wsSocket) with on-demand fetch plus 15 s polling, and show a blocking "Debug surface unavailable" screen on connection failure - transcript: add global attachment/interaction/todo entities (model, ops, wire schema) and project them from engine events in kap-server's coreEventMap * fix(kimi-inspect): drop the unused TranscriptTodo import	2026-07-20 15:33:05 +08:00
Kai	365ba0001d	fix: use timestamped default filename for session debug exports (#1788) ... Both engine implementations defaulted the export ZIP path to <sessionId>.zip, so running /export-debug-zip or kimi export twice for the same session silently overwrote the first archive. The default filename is now kimi-debug-<shortId>-<timestamp>.zip (UTC, second precision), matching the /export-md naming convention. Explicit -o/outputPath behavior is unchanged.	2026-07-16 19:32:06 +08:00
github-actions[bot]	36b05820cb	ci: release packages (#1767) ... Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-16 18:54:29 +08:00
qer	d1ca65e1de	feat(vscode): migrate extension to Node SDK (#1769) ... * feat(vscode): migrate extension to Node SDK * fix(vscode): address CI failures * fix(vis): handle token count records * fix(vscode): keep chat toolbar and header readable at narrow widths * fix(vscode): map yolo to core yolo permission and honor the global yolo setting * docs(vscode): record Node SDK migration design * docs(vscode): split breaking changes out of the 0.6.0 changelog * fix(vscode): keep a resumed session's thinking effort instead of reapplying the default * fix(vscode): announce session status when a view attaches so the display matches it * fix(vscode): align webview thinking effort handling with the TUI	2026-07-16 17:27:21 +08:00
Kai	f0c8a103c6	fix: preserve the crash error in diagnostic logs on unexpected exit (#1757) ... The TUI crash path (uncaughtException / unhandledRejection) logged the error into an asynchronously-drained sink and then called process.exit() on the same tick, so the one line explaining the crash was never written to disk. Flush the diagnostic logs synchronously before exiting.	2026-07-16 01:26:27 +08:00
_Kerman	df75a0f5c2	refactor(agent-core-v2): derive session busy from agent activity (#1751)	2026-07-15 23:33:58 +08:00
Haozhe	3703d0346e	feat(agent-core): default print mode to steer with unbounded limits (#1722) ... - change the default print background mode from 'exit' to 'steer' so `kimi -p` stays alive while background tasks are pending and each completion steers a new main turn - add print-mode config defaults (applyPrintModeConfigDefaults): effectively unbounded wait ceiling and turn cap, 72h subagent timeout; explicit user config always wins - thread the new `uiMode` option from SDKRpcClient through KimiCore into session create/resume - clamp setTimeout delays to 0x7fffffff so huge timeouts are not clamped to 1ms by Node	2026-07-15 11:11:00 +08:00
7Sageer	d601847f22	fix: send the product User-Agent on provider registry and catalog fetches (#1597) ... * fix: send the product User-Agent on provider registry and catalog fetches Registry (api.json) and models.dev catalog fetches only carried the runtime default User-Agent while every other outbound request sends kimi-code-cli/<version>. Thread an optional userAgent through fetchCustomRegistry / fetchCatalog and the shared refresh host, pass the product UA from the CLI, TUI, and both daemons, and seed a default product UA in kap-server that hosts can override via opts.seeds. * refactor: use options for registry fetches	2026-07-13 17:45:34 +08:00
_Kerman	bc8eb1e417	chore: drop #/ import array fallbacks and custom resolution plugins (#1594)	2026-07-13 16:37:35 +08:00
Haozhe	ceb158dc54	feat(v2): land agent-core-v2 engine and kap-server behind experimental flag (#1441) ... * fix: adapt grep tool to agent-core-v2 * fix(agent-core-v2): enrich PATH from the user's login shell at startup - port probeLoginShellPath/mergeLoginShellPath/applyLoginShellPath into _base/execEnv/loginShellPath.ts as a pure helper (no DI) - export execFileText from environmentProbe for reuse by the probe - run applyLoginShellPathFromNode concurrently with the host probe in HostEnvironmentService, mirroring kaos LocalKaos.create() Aligns agent-core-v2 with kaos 021786f5 so the Bash tool finds user-installed tools (e.g. Homebrew's gh) when kimi-code is launched from a GUI or non-login shell. * fix(agent-core-v2): prefer persisted cwd on resume * feat(agent-core-v2): support structured response formats * fix: restore v2 grep telemetry and tests * fix: preserve v2 compaction boundary * fix(agent-core-v2): align agent and swarm tool behavior * feat(ws-v1): add per-agent event subscription filter - protocol: add optional agent_filter to client_hello and subscribe - kap-server: carry per-subscription agent allowlists through the broadcaster and connection, narrowing live fan-out and replay to selected agents while keeping a single global sequence and bypassing the filter for global events - agent-core-v2: degrade MiniDbQueryStore to a no-op read model when the query-store lock is held by another process instead of crashing the host * feat(web): prefix skill slash commands with skill: to distinguish them from built-in commands (#1492) * ci: release packages (#1468) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * docs(changelog): sync 0.23.2 from apps/kimi-code/CHANGELOG.md (#1496) * chore: add changeset for agent swarm parity * fix: align v2 compaction prompt * fix: recover v2 compaction from plain 413 * fix: report v2 compaction retry telemetry * fix: align MCP discovery and output with v1 * fix: align v2 compaction auth guards * fix: align v2 grep behavior with v1 * chore: remove agent swarm changeset * fix(agent-core-v2): restore task resume parity * feat(agent-core-v2): record llm request traces * fix(agent-core-v2): align AskUserQuestion tool chain with v1 - translate wire ids back to question text / option labels when resolving a question over REST, joining multi-select labels with ', ' - enforce unique question texts / option labels and non-empty strings at both the schema and the execution path - cancel pending questions on turn abort or background task stop by dismissing the parked entry (resolves null, v1 broker semantics) - restore the unsupported-client fallback and dismissed-error handling - pass empty header / option description through verbatim and align the model-facing tool description byte-for-byte with v1 - drop the synthetic expires_at field from the question wire shape * fix(agent-core-v2): preserve compaction hook session * test(agent-core-v2): cover concurrent agent background limit * fix(agent-core): report EXIF-rotated image dimensions and raise edge cap to 3000px (#1460) * fix(agent-core): report EXIF-rotated image dimensions and raise edge cap to 3000px Image compression now reports original dimensions in the decoded (EXIF-rotated) space, matching the coordinate system of the sent image and of ReadMediaFile region readback; previously portrait JPEGs (orientation 5-8) got swapped width/height in captions. The longest-edge downscale cap rises from 2000px to 3000px, and the default jimp resize path is documented as the anti-aliased area-average one so it is not accidentally switched to a point-sampled interpolation mode. * test: shrink oversized image fixtures to fit CI timeouts The 3600x3600 fixtures introduced for the 3000px edge cap nearly doubled the pixel area jimp has to decode and deflate, pushing the slowest compression tests past the 5s vitest timeout on CI runners. 3600x1800 keeps every fixture over the cap while restoring roughly the workload of the old 2600x2600 fixtures that CI handled comfortably. * test: pin anti-aliased downscale quality with executable guards A 1px checkerboard probe pins the compressor to full-coverage averaging at integer and fractional ratios, with jimp's point-sampled BILINEAR mode kept as the executable aliasing counter-example (it collapses the 50%-gray pattern to solid black at 4:1). Also guards the other classic downscale bugs: transparent-pixel color bleed, mean-brightness drift, iterative recompression degradation, and zero-size collapse on extreme aspect ratios. * fix(agent-core): report decoded EXIF-rotated dimensions in ReadMediaFile notes The media note derived its original-dimensions line from the header sniff, which reports pre-rotation values for EXIF orientation 5-8 JPEGs. The sent image and region readback both live in the decoded (rotated) space, so portrait photos got axis-swapped coordinate guidance. Once a decode has happened — compression or crop — its dimensions now overwrite the sniffed ones. * fix(agent-core): improve handling of EXIF orientation in image dimensions and metadata * fix(agent-core): sniff EXIF orientation and step budget fallback through 2000px Two follow-ups to the EXIF and 3000px-cap changes: sniffImageDimensions now reads the JPEG EXIF Orientation tag (pure header parse, both byte orders) and reports display-space dimensions for orientations 5-8. Passthrough images — never decoded — previously kept the pre-rotation header size in compression results and media read notes, disagreeing with the decoded space that region readback uses. encodeWithinBudget steps the over-budget fallback through 2000px before the 1000px last resort. Raising the cap to 3000px had left a regression window: an image whose 2000px encode fits the byte budget was sent at 1000px where the old 2000px cap used to send it at 2000px. * fix(kimi-code): record pasted image dimensions in display space The TUI paste path recorded attachment and original dimensions from its raw header parser, which ignores EXIF orientation. For a portrait JPEG the submit-time caption then contradicted the sent image's aspect and region readback coordinates were axis-swapped. Dimensions now come from the compression result, which reports display space on both the compressed and passthrough paths; parseImageMeta remains only the format/mime gate. * feat(agent-core): add image compression and crop telemetry Every image ingestion path now reports an image_compress event — outcome (compressed / passthrough fast, guard, unsupported, unhelpful, error), input/output formats, byte and pixel sizes, EXIF transposition, and duration — and region readback reports an image_crop event with a failure classification and the region's share of the original area. Wiring is per call site via a new CompressImageOptions.telemetry option, so the outcome split and timing are measured inside the compressor while each caller only names its source: ReadMediaFile (tool construction, like GrepTool), MCP tool results (McpOutputOptions), server prompt ingestion (ICoreProcessService now exposes the host telemetry client), ACP prompts (session track adapter), and TUI paste (host.track adapter). Properties are numeric/enum only — never paths or content — and a throwing client can never affect the compression result. * fix(agent-core): run the full JPEG quality ladder at fallback sizes The fallback rescales encoded only at quality 20, so a JPEG whose ladder failed at the fitted size collapsed straight to the lowest quality even when the smaller size left budget headroom for a higher rung (the realistic window is the 1000px step, where the 4x pixel drop pays for q80/q60). Each fallback edge now walks the same q80-to-q20 ladder as the fitted size. * test: shrink heavy JPEG fixtures and add explicit timeouts The fallback-ladder test runs ~11 pure-JS JPEG encodes and the EXIF paste test decodes, rotates, and re-encodes a 6.5MP frame; both sat at the edge of the 5s vitest timeout on CI runners. Narrower fixtures cut the pixel area (the ladder test keeps its width above 2000px so the full fallback chain still runs) and explicit 15s timeouts absorb runner variance. * fix(server): scope prompt image compression telemetry to the session The prompt-ingestion image_compress events were emitted with the bare host telemetry client, while every agent-side source inherits a session-scoped client — so prompt_inline/prompt_file events could not be correlated with their session. The route now wraps the client with withTelemetryContext({ sessionId }) like rpc/core-impl does for session telemetry. * chore(changeset): consolidate image compression changesets One entry covering the cap raise and the EXIF dimension fix, listed for both the CLI and the SDK so the SDK changelog's compression description (previously pinned at 2000px) stays accurate. * fix: count goal creation turn (#1477) * feat(kosong): support structured response formats (#1397) * fix: clarify goal blocked audit guidance (#1481) * feat(agent-core): discard loaded tool schemas on compaction (#1471) Align progressive tool disclosure with the discard-on-compaction model: compaction no longer rebuilds loaded dynamic tool schemas. The boundary announcement re-lists every loadable name, the model re-selects what it still needs, and a from-memory call to a no-longer-loaded tool is rejected by preflight with select guidance. This removes the keep-all rebuild and its half-trigger budget heuristics entirely: the post-compaction floor is back to users + summary, which is structurally outside the auto-compaction trigger band, and the guard baseline degenerates to summary + reinjected reminders. Every downstream mechanism already treated the empty loaded set as its consistent base state (ledger scan, pending clear at the compaction boundary, deferred extras, preflight wording), so this is a strict simplification. Co-authored-by: fengchenchen <fengchenchen@moonshot.ai> * fix(kimi-code): exit 1 when a headless (-p) turn fails (#1483) Headless (`kimi -p`) failures could exit with code 0 when the event loop drained during the shutdown cleanup (e.g. telemetry's unref'd retry backoff when the network is blocked), because the rejection never reached the process.exit(1) call. Set the failure exit code before any await in both the run-prompt catch and the main catch, and keep the cleanup timeout ref'd so the loop stays alive long enough for the rejection to propagate. * feat(plugins): add Vercel plugin to marketplace (#1489) * feat(web): support Enter key to confirm archive and other dialogs (#1490) * feat(web): redesign cron reminder as a message bubble (#1480) * feat(web): redesign cron reminder as a message bubble Restyle the cron trigger notice as a right-aligned user-style message bubble that shows the scheduled prompt in full (wrapping across lines), with a small meta row beneath it for the schedule, status, job id and run time. Extract a shared MessageTime component used by both user messages and the cron reminder so the timestamp format and click-to-expand behavior stay consistent, and give the CronCreate/CronList/CronDelete tools distinct calendar icons. * refactor(web): render cron reminders only as standalone turns Remove the embedded cron block path from the web transcript projector so cron reminder fires always render through the standalone right-aligned bubble path. * chore(web): simplify cron redesign changeset * fix(web): composer model switch also updates global default model (#1491) * fix(web): composer model switch also updates global default model The composer model switcher still switches the active session's model via POST /sessions/{id}/profile (awaited, so the model pill reflects the result), and additionally fires POST /api/v1/config with { default_model } as a fire-and-forget side effect so new sessions inherit the chosen default. The config request is skipped when the model already matches the current default. * fix(web): route ModelPicker overlay selection through the default-model update The overlay opened from the composer's "More models" row (and /model) is a continuation of the same switch flow, so its selection now also bumps the global default model instead of only switching the active session. * fix(web): only persist the default model after a confirmed session switch setModel now returns whether the switch was accepted (true for the draft path), so the composer flow no longer writes a stale or invalid model alias into the global config when the session-level switch failed and rolled back. * feat(web): prefix skill slash commands with skill: to distinguish them from built-in commands (#1492) * ci: release packages (#1468) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(agent-core-v2): restore native append for Write append mode - add IHostFileSystem.appendText backed by fs.appendFile (O_APPEND) - route WriteTool append through it instead of read-then-rewrite, so existing content is never read, truncated, or clobbered by concurrent writers and a crash mid-append can only lose the new bytes - update typed host-fs test fakes and WriteTool append assertions * fix(agent-core-v2): align task tool prompts with v1 * fix(agent-core-v2): align compaction empty retry * fix(agent-core-v2): restore web search source site and citation reminders - surface source site: add WebSearchResult.siteName, map site_name in the Moonshot provider, and render the Site: line in tool output - restore the per-search inline citation reminder alongside the results - align web-search.md with v1: source-site/result-summary guidance and the static citation reminder * fix(agent-core-v2): route task timeouts through SIGTERM grace + SIGKILL - add terminateWithGrace shared by stop, timeoutMs, detachTimeoutMs, and track deadlines: cancel/SIGTERM -> 5s grace -> forceStop (SIGKILL) - coerce a post-abort self-settled `killed` to `timed_out` so a deadline stays reported as timed_out, matching v1 settlementForOutcome - add manager tests for SIGTERM-ignored escalation, graceful-exit within the grace window, and detachTimeout teardown * fix(agent-core-v2): restore fs.grep streaming early-kill and symlink reporting - stream `rg --json` in fs.grep and SIGKILL once max_total_matches/max_files is reached, restoring v1 early-stop instead of buffering the whole output - report symlinks as kind 'symlink' in fs search/list/stat via lstat and never descend into symlinked directories - remove the unused os grepSearch helper (dead, non-streaming, bypassed ISessionProcessRunner) * test(agent-core-v2): align truncated compaction retry * fix(agent-core-v2): align MCP tool results with v1 * fix(agent-core-v2): align blocked compaction failures * fix(agent-core-v2): align manual compaction tool projection * fix(agent-core-v2): preserve tail in windowed compaction * fix(agent-core-v2): read todos from wire model, sanitize replay - make SessionTodoService a stateless facade over the main agent's TodoModel: getTodos reads wire.getModel(TodoModel) live, setTodos only dispatches a todo.set op, and onDidChange is bridged from wire.subscribe(TodoModel); the in-memory list copy is gone so the live and post-replay views cannot drift - sanitize todo.set payloads in apply via readTodoItems, so replayed or hand-written records cannot poison the model or downstream renders - update todo tests to a sanitizing/notifying/replaying wire stub and cover malformed todo.set replay and main-absent reads - record the main-agent-wire persistence debt for the ISessionWireService move * fix(agent-core-v2): port v1 Bash tool output cap, saved-output reference, and background gating (#1503) * fix: align v2 task observable behavior * fix: v2 full compaction * fix(agent-core-v2): align task wait timeout behavior * chore: webSearch & FetchUrl Sync #1260 * fix: align background agent guidance * fix(agent-core-v2): align full compaction with v1 * fix(agent-core-v2): align v1 wire records * fix(agent-core-v2): remember observed compaction context window * fix: align Agent / AgentSwarm * fix(agent-core-v2): port v1 parity fixes for hooks, anthropic, thinking config and add-dir (#1504) * fix(agent-core-v2): hide console window when running hooks on Windows Port the v1 hooks runner fix: extract buildHookSpawnOptions and pass windowsHide:true so hook child processes no longer flash a console window on Windows, mirroring the node-local process host defaults. Includes the same regression tests as v1. * fix(agent-core-v2): port anthropic max_tokens ceiling and override fixes Port two v1 kosong fixes to the v2 anthropic provider: - Fall back to the nearest lower catalogued minor when resolving the Claude output ceiling, and catalogue Opus 4.8's documented 128k cap, so an uncatalogued minor no longer drops to the family baseline. - Treat an explicit defaultMaxTokens as the final max_tokens value instead of clamping it to the built-in ceiling. Mirrors the v1 regression tests in a new anthropic-max-tokens test file. * refactor(agent-core-v2): converge thinking config to enabled/effort Port the v1 thinking-config overhaul (#1132's config side) to v2: - ThinkingConfigSchema becomes { enabled, effort, keep }; the mode enum, the separate defaultThinking section, and the KIMI_MODEL_THINKING_MODE / KIMI_MODEL_DEFAULT_THINKING env bindings are removed. - The effort resolver drops the mode/defaultThinking branches and no longer normalizes a requested 'on' to a concrete effort in core; 'on' is taken verbatim and normalization stays at the UI boundary. - OAuth login/refresh and catalog refresh now persist the thinking.enabled value computed by the shared oauth apply/restore logic instead of dropping it and writing the removed default_thinking key, so [thinking] enabled = false actually disables thinking and the login default survives on disk. Mirrors the v1 resolver regression tests and adds a persistence regression for the refresh path. * docs(agent-core-v2): fix stale loop-event comments after wire parity The v1.4 wire-parity alignment switched the v2 live loop to stream turns as context.append_loop_event records, but three comments still described the old world (restore-only Op, "v2 never emits loop events"). Update them to match the actual write path: non-loop appends use append_message, the loop persists loop events byte-compatible with v1, and the fold runs both at live dispatch time and on replay. * fix(agent-core-v2): load workspace additional dirs on session create and resume The /add-dir command persisted remembered dirs to .kimi-code/local.toml, but session materialization never read them back and offered no caller additionalDirs entry point — a remembered dir silently stopped applying to new, resumed, and forked sessions. Mirror v1's createSession/resumeSession: merge the project-local local.toml dirs with caller-supplied additionalDirs (relative paths resolve against workDir) and seed the session workspace context in materializeSession, so create/resume/fork all pick them up. A broken local.toml fails the create loudly with CONFIG_INVALID, same as v1. Tests mirror v1's runtime coverage for the load/merge/dedupe/resume/fork scenarios. * fix(kimi-code): forward create-session additional dirs from the v2 harness The in-process v2 print-mode harness dropped the SDK CreateSessionOptions additionalDirs when calling ISessionLifecycleService.create, so --add-dir never reached the v2 resolver. Pass it through. * fix(agent-core-v2): align full compaction observability * fix(agent-core-v2): remove compact hook trigger state * feat(agent-core-v2): enhance agent lifecycle with context size tracking and concurrency checks * fix(agent-core-v2): align media reads with v1 note channel and EXIF handling (#1505) * fix(agent-core-v2): align media reads with v1 note channel and EXIF handling Port two agent-core changes into agent-core-v2: - Move the ReadMediaFile media summary from an inline <system> text part onto the tool result's note side channel, so raw <system> markup never renders in UIs (matching the MCP output path). - Report image dimensions in the decoded EXIF-rotated space: the header sniff now reads the JPEG Orientation tag, and once a decode happened (compression or crop) its dimensions overwrite the sniffed ones, so portrait photos no longer get axis-swapped coordinate guidance. - Raise the longest-edge downscale cap from 2000px to 3000px, step the over-budget fallback through 2000px before the 1000px last resort, and run the full JPEG quality ladder at fallback sizes. - Report image_compress / image_crop telemetry for media reads (source read_media), with EXIF transposition and crop failure classification. The tool description also regains the downsampling recovery guidance (region / full_resolution readback) that the v2 copy predated. * fix(agent-core-v2): align v1 wire records * fix(agent-core-v2): hide compression captions and register media tools in production Port the remaining v1 media gaps into agent-core-v2: - Reroute inline image-compression captions out of user messages: the prompt service splits them at the append chokepoint (prompt and steer flush) and delivers them through the built-in system-reminder injection (origin {kind: 'injection', variant: 'image_compression'}), which every UI hides. Session titles/lastPrompt strip the caption the same way. The model still receives the full note. - Register ReadMediaFile in production: media tools cannot use the module-level contribution table (capabilities are unknown until a model binds), so a new Eager agent-scope registrar re-runs registerMediaTools on every agent.status.updated where the model alias or its media capabilities changed, rebinding the video uploader and dropping the tool when the model loses media input. * fix(agent-core-v2): port v1 parity fixes for hooks, anthropic, thinking config and add-dir (#1504) * fix(agent-core-v2): hide console window when running hooks on Windows Port the v1 hooks runner fix: extract buildHookSpawnOptions and pass windowsHide:true so hook child processes no longer flash a console window on Windows, mirroring the node-local process host defaults. Includes the same regression tests as v1. * fix(agent-core-v2): port anthropic max_tokens ceiling and override fixes Port two v1 kosong fixes to the v2 anthropic provider: - Fall back to the nearest lower catalogued minor when resolving the Claude output ceiling, and catalogue Opus 4.8's documented 128k cap, so an uncatalogued minor no longer drops to the family baseline. - Treat an explicit defaultMaxTokens as the final max_tokens value instead of clamping it to the built-in ceiling. Mirrors the v1 regression tests in a new anthropic-max-tokens test file. * refactor(agent-core-v2): converge thinking config to enabled/effort Port the v1 thinking-config overhaul (#1132's config side) to v2: - ThinkingConfigSchema becomes { enabled, effort, keep }; the mode enum, the separate defaultThinking section, and the KIMI_MODEL_THINKING_MODE / KIMI_MODEL_DEFAULT_THINKING env bindings are removed. - The effort resolver drops the mode/defaultThinking branches and no longer normalizes a requested 'on' to a concrete effort in core; 'on' is taken verbatim and normalization stays at the UI boundary. - OAuth login/refresh and catalog refresh now persist the thinking.enabled value computed by the shared oauth apply/restore logic instead of dropping it and writing the removed default_thinking key, so [thinking] enabled = false actually disables thinking and the login default survives on disk. Mirrors the v1 resolver regression tests and adds a persistence regression for the refresh path. * docs(agent-core-v2): fix stale loop-event comments after wire parity The v1.4 wire-parity alignment switched the v2 live loop to stream turns as context.append_loop_event records, but three comments still described the old world (restore-only Op, "v2 never emits loop events"). Update them to match the actual write path: non-loop appends use append_message, the loop persists loop events byte-compatible with v1, and the fold runs both at live dispatch time and on replay. * fix(agent-core-v2): load workspace additional dirs on session create and resume The /add-dir command persisted remembered dirs to .kimi-code/local.toml, but session materialization never read them back and offered no caller additionalDirs entry point — a remembered dir silently stopped applying to new, resumed, and forked sessions. Mirror v1's createSession/resumeSession: merge the project-local local.toml dirs with caller-supplied additionalDirs (relative paths resolve against workDir) and seed the session workspace context in materializeSession, so create/resume/fork all pick them up. A broken local.toml fails the create loudly with CONFIG_INVALID, same as v1. Tests mirror v1's runtime coverage for the load/merge/dedupe/resume/fork scenarios. * fix(kimi-code): forward create-session additional dirs from the v2 harness The in-process v2 print-mode harness dropped the SDK CreateSessionOptions additionalDirs when calling ISessionLifecycleService.create, so --add-dir never reached the v2 resolver. Pass it through. * fix(agent-core-v2): report video_upload telemetry for media reads Port the v1 video-upload telemetry wrapper into createVideoUploader: every upload emits a video_upload event with outcome (success/error), byte size, mime type, duration, and the caller's static props (model alias, protocol tags), and a throwing telemetry client never affects the upload outcome. The media-tools registrar supplies the sink and props from the bound model. Also restores two v1 rationale comments in ReadMediaFile (original-size reporting and the full_resolution hard refusal) that were dropped during the earlier port. --------- Co-authored-by: 7Sageer <7sageer@djwcb.cn> Co-authored-by: liruifengv <liruifeng1024@gmail.com> * refactor(agent-core-v2): remove the microCompaction domain - delete the microCompaction domain (service, wire model/op, config section, experimental flag) and its dedicated tests - stop truncating old tool results in the context projector and drop the projector's now-unused instantiation dependency - remove the domain from the layer map, package exports, and the DI x Scope dependency diagram - retarget the flag-registry test and skill examples at a neutral flag * fix(contextProjector): surface projection repairs via log warning - add ProjectionAnomaly + onAnomaly sink through the project / projectStrict passes (reorder, synthesize, orphan / duplicate drop, leading drop, merge, blank-text drop) so the pure projection reports every wire-repair it applies - AgentContextProjectorService injects ILogService and emits a single signature-deduped 'repaired the request to keep it wire-valid' warning, excluding trailing-tail synthesis, matching agent-core parity - cover the trace and its dedup in the projector tests * fix(agent-core-v2): fix cron killswitch, lost deliveries, id clashes - killswitch: read KIMI_DISABLE_CRON live by re-applying the ConfigService env overlay on every get(); CronCreate reads it via ISessionCronService instead of a value frozen at tool registration - delivery: resolve fire delivery on promptService.steer().launched so a rejected launch retains one-shot tasks for retry instead of deleting them; tick() is now async and awaits delivery before advancing cursors - ids: switch cron task ids to ULIDs (from 32-bit hex) so two sessions sharing a workspace cannot overwrite each other's persisted task; CronDelete and persistence accept both ULID and legacy 8-hex ids - display: CronCreate reports nextFireAt through the service so it honors KIMI_CRON_NO_JITTER and matches the scheduler and CronList - migration: adopt shape-valid tasks with no sessionId tag on loadFromStore and stamp the tag back to disk - persistence: create cron directories 0700 and files 0600 via FileStorageService dirMode/fileMode Gate SessionCronService startup on config.ready and resolve clocks after ready so config is never read before it is loaded; start() is now async. * feat(fs-watch): add workspace fs watch with v1-compatible WS delivery - os layer: add IHostFsWatchService over chokidar (raw create/modify/delete, .git ignored) - session layer: add ISessionFsWatchService, a workspace-confined, debounced, .gitignore-aware FsChangeEvent feed - kap-server: add FsWatchBridge pushing event.fs.changed over /api/v1/ws (watch_fs_add/remove, volatile, per-connection filter), byte-compatible with v1 - tests: os/session unit tests and kap-server fs-watch e2e * refactor(agent-core-v2): run external hooks through IHostProcessService - inject IHostProcessService into ExternalHooksRunnerService and thread it through runMatchedHooks to runHook instead of spawning node:child_process - route hook termination through the service's cross-platform process-tree kill - settle on the exit code plus drained stdout/stderr so fast-exiting hooks keep their trailing output - hide the child console window on Windows via the service default - update externalHooks tests for the new dependency * fix(agent-core-v2): strict-decode Edit reads, align with v1 - read the Edit target with errors:'strict' so a non-UTF-8 file fails the edit instead of being silently rewritten as U+FFFD (matches v1 kaos) - declare readWriteFile access since Edit reads before it writes, matching v1 - render edit.md directly instead of through renderPrompt: it has no template vars, and raw avoids treating literal {{ }} as a template - restore the replace_all usage example in edit.md (v1 #1102) - add a regression test asserting a non-UTF-8 file fails the edit and keeps its bytes untouched * fix(agent-core-v2): dedupe AgentMeta legacy field declarations * refactor(agent-core-v2): persist wire records natively in the v1 vocabulary Remove the persist-time v1 rewrite layer (serializeV1WireRecord): ops now write v1-shaped records directly, live-only state is declared persist:false on the op instead of being stripped at write time, and the swarm-exit reminder pop replays from the swarm_mode.exit record via a cross-model reducer. Fixes resumed sessions losing the todo list, drifting turn counters after retries, and removed reminders reappearing on resume. * refactor(agent-core-v2): move ReadTool status block to note side channel - ReadTool.finishReadResult now returns rendered lines as `output` only and rides the `<system>` status block on the model-only `note` side channel - drop the finishOutput helper that concatenated content and status - update read.test.ts expectations to assert `note` separately from `output` * refactor(agent-core-v2): split blob service helpers, rewrite tests - extract rewriteMediaUrls and blobref parse/format helpers to dedupe URL rewriting - move the byte-bounded LRU cache into a module-private ByteLruCache with focused unit tests, dropping the protected maxCacheSize test seam - rewrite blob service tests against the contract on in-memory storage, removing cache-internals cases * fix: make release-e2e scenarios pass under agent-core-v2 Three independent fixes for release-e2e failures that only appeared with the experimental v2 engine (KIMI_CODE_EXPERIMENTAL_FLAG): - agent-core-v2: register the KIMI_MODEL env overlay statically so it takes effect even when ModelService is not instantiated (the DI layer does not auto-instantiate Eager services). Fixes wire-llm-request-trace. - cli: omit the leading system.version meta line in stream-json prompt mode so the role sequence stays clean. Fixes stream-json-cron. - agent-core-v2: honor --skills-dir via a new explicit skill source seeded from the host. Fixes interactive-skills-dir. Cherry-picked from 2a7232737 (v2-migration), excluding the node-sdk V2Host change (not applicable on this branch). * refactor(agent-core-v2): drop replay-only wire ops Remove the three replay-only Ops that were kept for pre-alignment / 1.5 sessions, now that v2 persists natively in the v1 vocabulary: - turn.launch (replaced by turn.prompt) - todo.set (replaced by tools.update_store with key 'todo') - context.splice (replaced by context.append_message / append_loop_event) Also drop the dead code that handled them (transcript reducer, task-origin extraction, blob dehydration, harness helpers) and migrate the affected tests to the v1 record types. The live write path already emitted only v1 records, so wire.jsonl output is unchanged. * Revert "fix: make release-e2e scenarios pass under agent-core-v2" This reverts commit ec9dae72ab. * fix(agent-core-v2): use a fresh TextDecoder per append-log read The module-level TextDecoder is stateful in stream mode: it buffers a trailing incomplete multi-byte sequence until the next decode. Sharing it across reads let leftover state from an earlier read that returned early (e.g. ensureWireMetadata bailing on the leading metadata record) leak into the next read and prepend a U+FFFD to its first line, corrupting the metadata envelope and breaking session fork with "corrupted line 1". Give each read its own TextDecoder so decoder state never leaks between reads. * fix(agent-core-v2): register KIMI_MODEL env overlay statically The KIMI_MODEL_* effective overlay was registered by ModelService on construction, but the DI layer does not auto-instantiate Eager services, so the overlay never took effect when nothing resolved IModelService. This broke the release-e2e wire-llm-request-trace scenario, where KIMI_MODEL_NAME must synthesize the env model and its thinking capability. Move registration to module load via a new configOverlayContributions collector, drained by ConfigRegistry on construction — mirroring the existing configSectionContributions pattern. ModelService no longer depends on IConfigRegistry. * docs(agent-core-v2): clarify live-only op semantics * fix(agent-core-v2): preserve oversized tool results * chore: remove full compaction complete data type * fix(agent-core-v2): align foreground output cap * fix(agent-core-v2): gate skill prompt injection * chore(skills): bundle review and test lenses into kc-review - add agent-core-review umbrella skill with slop and test sub-skills - move write-tests rules into agent-core-review/test and drop the standalone skill * feat(v2): auto-mint session ids and harden print-mode background drain - make CreateSessionOptions.sessionId optional; SessionLifecycleService.create and fork now mint `session_<lowercase-uuid>` via a shared createSessionId helper, so edge layers stop minting their own ids (drop randomUUID in the v2 harness, ulid in kap-server) - rework V2Session.waitForBackgroundTasksOnPrint to re-enumerate each round, suppress terminal notifications while waiting, and bound the drain by [task].print_wait_ceiling_s (default 1h) instead of a hardcoded 30s cap, so kimi -p can run long tasks to completion without being steered into a new turn - add v2-session unit tests; seed session/agent/bootstrap context in the tool-dedupe harness for the real executor * fix(agent-core-v2): refresh system prompt after compaction * docs(agent-core-review): limit kc-review skill to agent-core-v2 Clarify that the kc-review lenses apply only to packages/agent-core-v2 (the DI x Scope engine), not to the legacy packages/agent-core or other packages. * fix(agent-core-v2): align model-facing prompts * fix(agent-core): report EXIF-rotated image dimensions and raise edge cap to 3000px (#1460) * fix(agent-core): report EXIF-rotated image dimensions and raise edge cap to 3000px Image compression now reports original dimensions in the decoded (EXIF-rotated) space, matching the coordinate system of the sent image and of ReadMediaFile region readback; previously portrait JPEGs (orientation 5-8) got swapped width/height in captions. The longest-edge downscale cap rises from 2000px to 3000px, and the default jimp resize path is documented as the anti-aliased area-average one so it is not accidentally switched to a point-sampled interpolation mode. * test: shrink oversized image fixtures to fit CI timeouts The 3600x3600 fixtures introduced for the 3000px edge cap nearly doubled the pixel area jimp has to decode and deflate, pushing the slowest compression tests past the 5s vitest timeout on CI runners. 3600x1800 keeps every fixture over the cap while restoring roughly the workload of the old 2600x2600 fixtures that CI handled comfortably. * test: pin anti-aliased downscale quality with executable guards A 1px checkerboard probe pins the compressor to full-coverage averaging at integer and fractional ratios, with jimp's point-sampled BILINEAR mode kept as the executable aliasing counter-example (it collapses the 50%-gray pattern to solid black at 4:1). Also guards the other classic downscale bugs: transparent-pixel color bleed, mean-brightness drift, iterative recompression degradation, and zero-size collapse on extreme aspect ratios. * fix(agent-core): report decoded EXIF-rotated dimensions in ReadMediaFile notes The media note derived its original-dimensions line from the header sniff, which reports pre-rotation values for EXIF orientation 5-8 JPEGs. The sent image and region readback both live in the decoded (rotated) space, so portrait photos got axis-swapped coordinate guidance. Once a decode has happened — compression or crop — its dimensions now overwrite the sniffed ones. * fix(agent-core): improve handling of EXIF orientation in image dimensions and metadata * fix(agent-core): sniff EXIF orientation and step budget fallback through 2000px Two follow-ups to the EXIF and 3000px-cap changes: sniffImageDimensions now reads the JPEG EXIF Orientation tag (pure header parse, both byte orders) and reports display-space dimensions for orientations 5-8. Passthrough images — never decoded — previously kept the pre-rotation header size in compression results and media read notes, disagreeing with the decoded space that region readback uses. encodeWithinBudget steps the over-budget fallback through 2000px before the 1000px last resort. Raising the cap to 3000px had left a regression window: an image whose 2000px encode fits the byte budget was sent at 1000px where the old 2000px cap used to send it at 2000px. * fix(kimi-code): record pasted image dimensions in display space The TUI paste path recorded attachment and original dimensions from its raw header parser, which ignores EXIF orientation. For a portrait JPEG the submit-time caption then contradicted the sent image's aspect and region readback coordinates were axis-swapped. Dimensions now come from the compression result, which reports display space on both the compressed and passthrough paths; parseImageMeta remains only the format/mime gate. * feat(agent-core): add image compression and crop telemetry Every image ingestion path now reports an image_compress event — outcome (compressed / passthrough fast, guard, unsupported, unhelpful, error), input/output formats, byte and pixel sizes, EXIF transposition, and duration — and region readback reports an image_crop event with a failure classification and the region's share of the original area. Wiring is per call site via a new CompressImageOptions.telemetry option, so the outcome split and timing are measured inside the compressor while each caller only names its source: ReadMediaFile (tool construction, like GrepTool), MCP tool results (McpOutputOptions), server prompt ingestion (ICoreProcessService now exposes the host telemetry client), ACP prompts (session track adapter), and TUI paste (host.track adapter). Properties are numeric/enum only — never paths or content — and a throwing client can never affect the compression result. * fix(agent-core): run the full JPEG quality ladder at fallback sizes The fallback rescales encoded only at quality 20, so a JPEG whose ladder failed at the fitted size collapsed straight to the lowest quality even when the smaller size left budget headroom for a higher rung (the realistic window is the 1000px step, where the 4x pixel drop pays for q80/q60). Each fallback edge now walks the same q80-to-q20 ladder as the fitted size. * test: shrink heavy JPEG fixtures and add explicit timeouts The fallback-ladder test runs ~11 pure-JS JPEG encodes and the EXIF paste test decodes, rotates, and re-encodes a 6.5MP frame; both sat at the edge of the 5s vitest timeout on CI runners. Narrower fixtures cut the pixel area (the ladder test keeps its width above 2000px so the full fallback chain still runs) and explicit 15s timeouts absorb runner variance. * fix(server): scope prompt image compression telemetry to the session The prompt-ingestion image_compress events were emitted with the bare host telemetry client, while every agent-side source inherits a session-scoped client — so prompt_inline/prompt_file events could not be correlated with their session. The route now wraps the client with withTelemetryContext({ sessionId }) like rpc/core-impl does for session telemetry. * chore(changeset): consolidate image compression changesets One entry covering the cap raise and the EXIF dimension fix, listed for both the CLI and the SDK so the SDK changelog's compression description (previously pinned at 2000px) stays accurate. * fix: count goal creation turn (#1477) * feat(kosong): support structured response formats (#1397) * fix: clarify goal blocked audit guidance (#1481) * feat(agent-core): discard loaded tool schemas on compaction (#1471) Align progressive tool disclosure with the discard-on-compaction model: compaction no longer rebuilds loaded dynamic tool schemas. The boundary announcement re-lists every loadable name, the model re-selects what it still needs, and a from-memory call to a no-longer-loaded tool is rejected by preflight with select guidance. This removes the keep-all rebuild and its half-trigger budget heuristics entirely: the post-compaction floor is back to users + summary, which is structurally outside the auto-compaction trigger band, and the guard baseline degenerates to summary + reinjected reminders. Every downstream mechanism already treated the empty loaded set as its consistent base state (ledger scan, pending clear at the compaction boundary, deferred extras, preflight wording), so this is a strict simplification. Co-authored-by: fengchenchen <fengchenchen@moonshot.ai> * fix(kimi-code): exit 1 when a headless (-p) turn fails (#1483) Headless (`kimi -p`) failures could exit with code 0 when the event loop drained during the shutdown cleanup (e.g. telemetry's unref'd retry backoff when the network is blocked), because the rejection never reached the process.exit(1) call. Set the failure exit code before any await in both the run-prompt catch and the main catch, and keep the cleanup timeout ref'd so the loop stays alive long enough for the rejection to propagate. * feat(plugins): add Vercel plugin to marketplace (#1489) * feat(web): support Enter key to confirm archive and other dialogs (#1490) * feat(web): redesign cron reminder as a message bubble (#1480) * feat(web): redesign cron reminder as a message bubble Restyle the cron trigger notice as a right-aligned user-style message bubble that shows the scheduled prompt in full (wrapping across lines), with a small meta row beneath it for the schedule, status, job id and run time. Extract a shared MessageTime component used by both user messages and the cron reminder so the timestamp format and click-to-expand behavior stay consistent, and give the CronCreate/CronList/CronDelete tools distinct calendar icons. * refactor(web): render cron reminders only as standalone turns Remove the embedded cron block path from the web transcript projector so cron reminder fires always render through the standalone right-aligned bubble path. * chore(web): simplify cron redesign changeset * fix(web): composer model switch also updates global default model (#1491) * fix(web): composer model switch also updates global default model The composer model switcher still switches the active session's model via POST /sessions/{id}/profile (awaited, so the model pill reflects the result), and additionally fires POST /api/v1/config with { default_model } as a fire-and-forget side effect so new sessions inherit the chosen default. The config request is skipped when the model already matches the current default. * fix(web): route ModelPicker overlay selection through the default-model update The overlay opened from the composer's "More models" row (and /model) is a continuation of the same switch flow, so its selection now also bumps the global default model instead of only switching the active session. * fix(web): only persist the default model after a confirmed session switch setModel now returns whether the switch was accepted (true for the draft path), so the composer flow no longer writes a stale or invalid model alias into the global config when the session-level switch failed and rolled back. * feat(web): prefix skill slash commands with skill: to distinguish them from built-in commands (#1492) * ci: release packages (#1468) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: surface provider auth error for unavailable models (#1506) * fix: surface provider auth error for unavailable models When an OAuth-managed model returns 401 after a forced token refresh, the token is valid but the provider rejected it for that model (the account lacks access). Emit provider.auth_error carrying the provider's message instead of auth.login_required with a misleading "OAuth login expired. Send /login" prompt. * fix(agent-core): preserve provider auth errors through compaction Treat provider.auth_error like auth.login_required in the compaction path so an auth rejection during compaction surfaces the provider's message instead of being wrapped as a generic compaction failure. * ci: release packages (#1507) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * docs(changelog): sync 0.23.3 and shorten OAuth error entry (#1509) * feat(kimi-web): add status-aware browser notifications (#1479) * feat(kimi-web): add approval notification storage key and i18n copy * feat(kimi-web): add approval notification helpers and tests * feat(kimi-web): wire approval notifications and guard completion alerts * fix(kimi-web): extract shouldNotifyCompletion helper and add tests * feat(kimi-web): add approval notification settings toggle * chore(kimi-web): add changeset and tidy notification module comment - Align approval notification tag with spec (kimi-approval-${approvalId}) - Update module header to describe all three notification kinds * fix(kimi-web): make notifications fire reliably - Key completion notification tags by turn (sid + promptId) and question tags by request id, so a stale notification left in the notification center no longer swallows every follow-up alert in the same session - Suppress notifications only while the window is actually focused, not merely visible (document.hasFocus() on top of visibilityState) - Play the attention sound when a tool needs approval, matching the completion and question sounds * chore(kimi-web): simplify changeset * fix(agent-core-v2): serialize concurrent model catalog refreshes Port v1 #1207's _refreshChain so a scheduled refresh and a manual one (or two overlapping manual ones) never race on reading/patching the persisted config. Applied to both refresh entry points: ModelCatalogService.refreshProviderModels (scheduler + all/single-provider) and OAuthService.refreshOAuthProviderModels (OAuth-only, a separate service in v2). * fix(agent-core-v2): dedupe workspace registry entries by root Port v1 #1221: collapse registered workspaces that share a root in list(), preferring the entry whose id matches the current canonical encodeWorkDirKey, so a legacy workspaces.json (v1-compatible) does not render the same folder twice through GET /workspaces. * fix(agent-core-v2): apply KIMI_CODE_CUSTOM_HEADERS and host identity headers Port v1's provider-manager outbound header logic to agent-core-v2 so `KIMI_CODE_CUSTOM_HEADERS` and host identity headers are applied to outbound LLM requests, closing the migration gap from #1186: - env `KIMI_CODE_CUSTOM_HEADERS` is the lowest-precedence header layer; - host identity headers (User-Agent + X-Msh-*) are sent for Kimi providers, only the User-Agent for every other provider — a Kimi provider routed through the Anthropic protocol still gets the full set, matching v1; - provider `customHeaders` always win on conflict. Host headers are seeded by the CLI via `createKimiDefaultHeaders` and a new `IHostRequestHeaders` App-scope token (defaulting to empty), so the model resolver can layer them without the host threading them through every call site. * chore(agent-core-review): rename skill from kc-review to agent-core-review * feat(kap-server): surface originating stack trace on error envelopes - add optional `stack` field to errEnvelope and the envelope schema/interface; omitted when undefined so the wire shape stays byte-identical for callers without a stack - thread `err.stack` through route error mappers plus the global and transport error handlers - preserve `details` on `session.undo_unavailable` while adding its stack - update tests to assert stacks are surfaced, reversing the prior no-leak contract * fix: align v2 media and task compaction handling * feat(agent-core-v2): sync shell mode and skill config parity (#1514) * feat(agent-core-v2): record shell command context - add ShellCommandOrigin and compaction handoff disposition - extract IAgentShellCommandService from AgentRPCService - keep AgentRPCService as a thin shell:run facade * fix(agent-core-v2): align skill priority and sync docs - restore project > user > plugin > builtin skill precedence - sync Skill tool description and parameter docs from v1 - update write-goal and custom-theme builtin skill copy * fix(agent-core-v2): restore undo and thinking telemetry - track conversation_undo after undoHistory - emit thinking_toggle with enabled/effort/from payload - add coverage for both telemetry events * feat(agent-core-v2): add skill directory config - add extraSkillDirs and mergeAllAvailableSkills config sections - introduce extra skill source and shared source priorities - align kap-server workspace skill preview with session catalog * feat(agent-core-v2): support explicit skill dirs - add ISkillCatalogRuntimeOptions for SDK-style explicit skill dirs - suppress default user/project discovery when explicitDirs are set - resolve explicit dirs per session workDir via explicitFileSkillSource * fix(agent-core-v2): fix configured skill dir resolution - expand ~ using OS home for configured skill dirs - honor explicitDirs in kap-server workspace skill preview * fix(agent-core-v2): await config ready before skill discovery - wait for config.ready before reading extraSkillDirs - wait for config.ready before reading mergeAllAvailableSkills - cover extra skill dir loading behind config readiness * fix(agent-core-v2): keep skill config live after changes - await config.ready in kap-server workspace skill preview - reload user and workspace skill sources when mergeAllAvailableSkills changes * fix(agent-core-v2): align goal budget handling * fix(agent-core-v2): forbid model goal pauses * fix(agent-core-v2): cap detached process output * fix(kimi-code): drain v2 print subagents before exit * fix: restore kap-server video upload compatibility * fix(agent-core-v2): charge only output tokens against goal token budgets Goal parity gap G2: v1 charges only per-step output tokens against a goal's tokenBudget, while v2 summed all four usage buckets (cache read, cache creation, other input, output), exhausting budgets orders of magnitude faster under prompt caching and skewing persisted tokensUsed counters. Align goal token accounting to output-only and drop the unused tokenUsageTotal helper. * fix: align server-v2 media file handling * feat(agent-core-v2): allow coder profile to use MCP tools * refactor(agent-core): introduce activity kernel and migrate turn lane - add `activity` domain: `IAgentActivityService` (Agent turn lane machine), `ISessionActivityKernel` (Session admission, PR1 placeholder), and the `ActivityLease` that owns the turn `AbortSignal` - turnService launches and cancels through the kernel lease; `Turn` now exposes `signal` instead of `abortController` - agentLifecycle.remove drives `beginDisposal`/`settled` and waits for the in-flight turn to drain before releasing the agent scope - add `activity.*` error codes; deprecate `turn.agent_busy` in favor of `activity.agent_busy` * refactor(sessionLegacy): remove fork/compact/abort/archive pass-throughs These four legacy session actions were thin delegations to the native v2 services (ISessionLifecycleService.fork/archive, IAgentFullCompactionService.begin, IAgentRPCService.cancel) with no v1-only projection to centralize. Drop them from ISessionLegacyService and call the native services directly from the kap-server sessions route. updateProfile, createChild, listChildren, undo and status stay in the adapter since they carry real v1 adaptation logic. * refactor(cli): run print-mode v2 on native agent-core-v2 services - add native v2 print runner (v2/run-v2-print.ts) that consumes agent-core-v2 DI services and awaits Turn.result directly - extract shared print-mode rendering into prompt-render.ts for v1 and v2 - remove the V2PromptHarness/V2Session shim and v2->v1 event translation - decouple initializeCliTelemetry from PromptHarness (homeDir/auth/track) - add IAgentPromptLegacyService.submitAndSettle for authoritative completion * refactor(session): serve v1 undo and children via native v2 services - make IAgentPromptService.undo throw session.undo_unavailable with a structured reason; move the precheck into contextMemory - add ISessionLifecycleService.createChild (fork + child markers) and ISessionIndex.list({ childOf }) - slim ISessionLegacyService to updateProfile/status (drop createChild, listChildren, undo) - rewire kap-server session routes to the native services and map SESSION_UNDO_UNAVAILABLE * refactor(cli): drop v1 sdk and telemetry deps from v2 print - run-v2-print: use core ITelemetryService + CloudAppender instead of kimi-telemetry; remove kimi-code-sdk import (auth via IOAuthToolkit, config path from bootstrap, hook result via structural type) - prompt-render: replace SDK HookResultEvent with a structural type so the shared renderer does not depend on the v1 SDK event shape - telemetry: revert initializeCliTelemetry to its original signature now that v2 no longer calls it; keep v1 callers and assertions untouched - update run-prompt and v2-run-print tests for the new wiring * feat(activity): add session lane machine and agent snapshot projector - implement SessionActivityKernel lane machine (restoring→active⇄quiescing→closing→disposed) with admission table, atomic quiesce+drain, beginClosing/settled, markActive - start AgentActivityService lane at initializing; add markReady driven by agentLifecycle.create after bootstrap - project LaneModel + EventBus facts into structured AgentActivitySnapshot (ActivityModel / setActivitySnapshot Op) with pending-approval and active-tool-call sets; emit agent.activity.updated - add IAgentTurnService.launchWithLease; goal continuation acquires the lane before appending its prompt - resolve pending interactions on turn.ended to avoid stranded awaiting_approval - fullCompaction registers a background activity and checks the activity lane - extract contextMemory publishSplice / isFullyUndoable / recoverFoldedLength helpers - kap-server: map activity snapshot into legacy status and sessionEventBroadcaster * fix(agent-core-v2): truncate over-long goal completion criteria Goal parity gap G11: v1 silently truncates a goal's completionCriterion to 4000 characters (the objective cap) before persisting, so an over-long criterion never fails creation and cannot bloat every goal reminder and record. v2 only trimmed whitespace and persisted arbitrary lengths verbatim. Cap the normalized criterion at MAX_GOAL_COMPLETION_CRITERION_LENGTH to match v1. * fix(agent-core-v2): add goal error catalog info metadata Align the GoalErrors domain with V1 by attaching the info block for the seven goal.* error codes (title, retryable, public, action hints) so errorInfo() surfaces them. Entries copied verbatim from the V1 error catalog. Gap: G43 * chore(nix): update pnpm deps hash * fix(agent-core-v2): retain queued steers when a turn ends cancelled or failed Align the prompt layer with V1's steer-buffer semantics: buffered steer input now survives a turn that ends cancelled or failed and is flushed into the next launched turn by the existing beforeStep hook, instead of being silently dropped. The turn-result observation in the prompt service existed only to perform that discard, so it is removed along with the now-trivial launch wrapper; explicit clear() still discards the queue. Gap: G24 * fix(agent-core-v2): remove ask-user background mode * fix(kap-server): align archived session restore * chore(lint): fix type-aware lint errors * chore(agent-core-v2): drop stray doResume debug log * fix(agent-core-v2): defer prompts and steers while a full compaction is in flight Align with V1's compaction gating: input arriving while a full compaction holds the context (and no turn is active) used to launch a turn immediately, appending assistant output that forced the in-flight compaction to cancel. The prompt service now buffers such input and replays it from a new onDidFinishCompaction hook that the compaction worker runs in a finally, so the buffer drains on completion, cancellation, and failure alike — the first deferred item launches a turn and the rest join the steer queue. The compaction service is resolved lazily instead of constructor- injected: materializing it during prompt-service construction reorders loop-hook registration and moves the full-compaction beforeStep hook ahead of the hooks that let a freshly launched prompt land in context before the auto-compaction check snapshots history. Gap: G23 * fix(agent-core-v2): re-inject the goal reminder after full compaction Align with V1: after a compaction rewrites the context, re-arm the per-turn context injectors and run them before the compaction is marked complete, so the first post-compaction request — including a replayed deferred prompt's — already carries the goal reminder the summary folded away. The injector service exposes injectAfterCompaction, which re-arms the new-turn flag and injects immediately; the compaction worker calls it after the system-prompt refresh and raises the post-compaction token floor to include the re-injected reminders (the pre-injection floor stays as the fallback when reinjection throws), so the nothing-new-since-compaction guard does not re-trigger against a shape that cannot shrink. The injector is resolved lazily from the compaction service to keep loop-hook registration order untouched across the dependency cascade. Matches V1 verbatim including the existing quirk where an idle manual compact yields a second reminder copy on the next turn's per-turn injection; the parity test pins that behavior. Gap: G14 * test(agent-core-v2): cover goal pause classification for provider errors Port the missing end-to-end coverage: goal-driven turn failures pause the goal with the exact per-class reason strings — provider rate limit, provider connection error, provider authentication error, provider safety policy block, and model configuration error (including the forced 'LLM not set' substitution). Failures are driven through a real turn with a throwing generate stub so the raw-error classification feeding the pause reason is exercised, not just the mapper. No source changes: the existing classification already matches the reference strings verbatim. Gap: G35 * feat: add progressive tool disclosure * feat(cli): gate print-mode v2 behind KIMI_MODEL_EXPERIMENT_FLAG - add KIMI_PRINT_V2_ENV / isPrintV2Enabled so `kimi -p` routes to the native agent-core-v2 runner through its own switch - keep `kimi server run` server-v2 routing on isKimiV2Enabled (KIMI_CODE_EXPERIMENTAL_FLAG), decoupling the two - update print-mode tests and comments to reference the new switch * feat(cli): add KIMI_MODEL_OUTPUT_FORMAT for print-mode default - resolve the effective `-p` format via resolveOutputFormat: the --output-format flag wins, then KIMI_MODEL_OUTPUT_FORMAT (prompt mode only), then text - ignore the env outside prompt mode and reject invalid values eagerly through the friendly validation path - apply the resolver on both the v1 and v2 print runners * fix(agent-core-v2): count the goal-creating turn as the first goal turn Goal parity gap G5: when the model creates or resumes a goal mid-turn, v1 counts that ordinary turn as goal turn 1 at turn end (with a budget re-check before the continuation driver takes over) and charges its remaining step output tokens against the token budget. v2 only flagged turns whose goal was already active at launch, leaving turnsUsed and tokensUsed off by one turn in the model-initiated flow. Adopt the live turn as a goal starter turn on activation: charge its post-creation step output, count it once at turn end via incrementTurn, and block instead of launching a continuation when that count exhausts the turn budget. * fix(agent-core-v2): remove model-initiated paused status from UpdateGoal Goal parity gap G6: v1 reserves pausing for the user and runtime — its UpdateGoal tool only accepts active/complete/blocked and rejects other statuses with an invalid-status error. v2 still carried a leftover 'paused' enum option, a model pauseGoal branch, and matching tool description wording from before v1 removed them. Drop the paused option, port v1's runtime invalid-status guard, and align the tool description with v1's. * fix(agent-core-v2): deliver goal outcome prompts through the UpdateGoal tool result Goal parity gap G7: when the model completes or blocks a goal, v1 returns the outcome prompt (stats plus final-message instructions) as the UpdateGoal tool result with stopTurn, keys the one-shot final- message continuation on that terminal tool result, and guards it with the per-turn step budget so a capped turn ends 'completed' instead of dying on max steps. v2 still used a pre-change leftover channel: terse tool outputs plus goal_completion_summary / goal_blocked_reason system reminders and a last-message-reminder continuation with no step-budget check. Return the outcome prompts as tool output, drop the reminder appends and their detection, key the continuation on the terminal UpdateGoal result observed via the tool executor hook, and mirror v1's hasStepBudgetRemaining guard. Also closes audit gaps G17 (max-steps death) and G27 (actor-conditional reminders). * fix(agent-core-v2): fail UpdateGoal as a tool error when no goal matches Goal parity gap G8 (with user modification): v1 returns friendly success-flagged no-op outputs when UpdateGoal targets a missing or non-active goal, while v2 either let GOAL_NOT_FOUND escape from resumeGoal or reported false success with stopTurn for complete and blocked on a non-active goal. Per the user's decision these cases now return error-flagged tool results in the same shape as the Edit tool's old-string-not-found failure - v1's message texts ('Goal not resumed: no current goal.', 'Goal not completed: no active goal.', 'Goal not blocked: no active goal.') with isError and no stopTurn, so the model sees a non-fatal failure and the turn continues normally. * fix(agent-core-v2): settle active goals when the continuation relaunch fails Goal parity gap P-B: the turn-ended subscriber that relaunches goal continuation turns discarded every rejection, so a failed launch (for example losing a race to a queued prompt) stranded the goal in status active with nothing driving it. Keep the event-driven per-turn continuation model but settle deterministically on failure: any rejection out of the turn-ended handling now pauses the active goal as actor system with reason 'Paused after goal continuation failure: <message>', emitting the normal goal.updated event; the settle itself never throws into the event bus. The busy-skip needs no settle: the turn service clears its active turn before publishing turn.ended, so the other live turn's own end reliably re-runs the relaunch check. * fix(agent-core-v2): restore the fork-cleared goal system reminder Goal parity gap G12: after a session fork, v1 tells the model the fork has no current goal so it ignores stale active-goal reminders copied from the source session; v2 cleared the goal silently through the forked wire op and dropped the reminder. Track the fork boundary in a derived (never persisted) wire model folded on both dispatch and replay: a forked record that clears a copied goal marks the reminder pending, and the post-replay pass appends v1's verbatim reminder text with origin goal_fork_cleared exactly once - the appended reminder record acknowledges the pending flag on later replays, so resumes never duplicate it. Forks of sessions without a goal append nothing. The forkGoal op itself stays pure. * fix(agent-core-v2): preserve turn result details (#1531) * feat(agent-core-v2): align defaultProvider fallback and clear-on-delete - ModelResolverService falls back to the top-level defaultProvider config when a model pins neither providerId/provider nor an inline baseUrl (v1 parity). - ProviderService.delete clears defaultProvider when removing the provider it points at, replacing v1's scattered call-site cleanups. - defaultProvider rides as an unregistered top-level scalar config section, mirroring defaultModel (no schema, generic snake/camel passthrough). * feat(agent-core-v2): synthesize legacy prompt lifecycle events - emit prompt.completed/aborted/steered on the per-agent IEventBus so the v1-compatible WS edge can forward them (v2 core only emits turn.ended) - bridge per-agent turn.ended into SessionInteractionService.cancelPendingForTurn via AgentLifecycleService (bus is Agent-scoped, no direct injection) - extract agent create() helpers: assertCanCreate, buildAgentScopeExtras, igniteEagerServices, bindBootstrap - finish assistant writer on PromptTranscriptWriter.flushAssistant - ungate live session status idle->running->idle e2e test (v2 backend pulls real status) * chore(agent-core-v2): align cron and skill prompts with agent-core Drop the KIMI_CRON_NO_JITTER / KIMI_CRON_NO_STALE notes from the CronCreate and CronList descriptions and the MAX_SKILL_QUERY_DEPTH sentence from the Skill description, matching agent-core (v1) where these were trimmed from the model-facing text in #1102. Code behavior is unchanged; the env bypasses and the depth cap still exist in both implementations. ULID/8-hex wording is left as-is for now. * chore(agent-core-v2): drop legacy 8-hex mention from cron prompts CronDelete and CronList descriptions now describe the task id as a ULID only, removing the "(or legacy 8-hex)" qualifier from the model-facing text. Code and tests are unchanged. * chore(agent-core-v2): reorganize tests to mirror src layout Move every file under test/ so its path mirrors the corresponding file under src/ one-to-one (agent/, session/, app/, os/, persistence/, _base/, activity/, wire/), and rename test files to match the basename of the source file they cover. Test-only infrastructure with no src counterpart (harness, snapshot, lint, dep-graph, tools/fixtures) stays at the top level. Rewrite imports after the move: src references use the #/ alias, while test-to-test and cross-package relative imports are recomputed for the new locations. No behavior changes. * feat(config): add default permission/plan mode and yolo alias - register `defaultPermissionMode` and `defaultPlanMode` config sections - apply `defaultPermissionMode` when creating the main agent - enter plan mode on fresh sessions when `defaultPlanMode` is true - fold `yolo: true` into `default_permission_mode` on kap-server config write, derive `yolo` on read (yolo stays wire sugar, never a persisted domain) * feat(agent-core-v2): add background mode to AskUserQuestion Align with v1: the model can pass `background: true` to get a task_id immediately while the question waits in the background for the user's answer; completion is delivered to the agent automatically through the task service's terminal notification. - New QuestionBackgroundTask (AgentTask kind 'question') that runs the question request on a detached task and settles completed/failed/killed. - AskUserQuestionTool gains the optional `background` schema field, the description suffix, an IAgentTaskService dependency, and a background execution branch whose output block matches v1 verbatim. - Tests: harness injects a task-service stub, two legacy 'no background' assertions are flipped to the v1-aligned behavior, and three background cases (immediate task_id, settle completed, abort killed) are added. * fix(agent-core-v2): synthesize default baseUrl for env-model provider Align with v1: when KIMI_MODEL_NAME is set without KIMI_MODEL_BASE_URL, the reserved __kimi_env__ provider now gets a per-type default baseUrl (kimi -> api.moonshot.ai/v1, openai -> api.openai.com/v1; anthropic is left unset so the SDK picks its default). Previously v2 left baseUrl empty and later threw "missing a base URL" for the openai env-model path, regressing v1's out-of-the-box behavior. An explicit KIMI_MODEL_BASE_URL still wins. * fix(agent-core-v2): restore UpdateGoal completion/blocked prompts and no-goal fallbacks Align with v1: completing or blocking a goal now returns the dynamic summary/blocked-reason prompt (buildGoalCompletionSummaryPrompt / buildGoalBlockedReasonPrompt, already present in outcome-prompts.ts but unused) instead of the static "Goal marked complete/blocked." text, and all three statuses report the "no active/current goal" fallback when there is nothing to transition. * feat(agent-core-v2): add [image] config section for image compression - add media-owned `image` config section (`max_edge_px`, `read_byte_budget`) with `KIMI_IMAGE_MAX_EDGE_PX` / `KIMI_IMAGE_READ_BYTE_BUDGET` env bindings (env > config.toml > default) - add Agent-scope `ImageConfigBridge` that pushes the env-resolved section into the image-compress resolver seam on load and on change, so all call sites honor config without per-call wiring - resolve `maxEdge` / read-byte-budget defaults in image-compress via the new seam; keep the support module config-agnostic - apply the read-image byte budget in ReadMediaFile's default downscale path (previously fell back to the 3.75 MB provider ceiling) * fix(agent-core-v2): align image compression defaults with v1 (#1508) Port v1 #1508 into v2: lower the longest-edge downscale cap back to 2000px (v2 was stuck on the 3000px it had ported from an earlier v1 change) and make it overridable, add the 256 KB read-image byte budget used by ReadMediaFile, and widen the over-budget fallback ladder to [2000, 1000, 768, 512, 384, 256]. - MAX_IMAGE_EDGE_PX 3000 -> 2000, with KIMI_IMAGE_MAX_EDGE_PX env and a config-pushed value resolved via resolveMaxImageEdgePx. - READ_IMAGE_BYTE_BUDGET=256KB with KIMI_IMAGE_READ_BYTE_BUDGET env and resolveReadImageByteBudget; ReadMediaFile's default compress path now uses it (region / full_resolution still honor IMAGE_BYTE_BUDGET). - Test expectations that hard-coded 3000px / 1500px updated to 2000 / 1000 to match the v1 behavior. The [image] config.toml section is intentionally not added: the env vars already cover the override path, and wiring a config section plus a runtime push would add v2-specific scaffolding beyond v1. * fix(agent-core-v2): restore HEIC/HEIF conversion guidance in ReadMediaFile Align with v1: a HEIC/HEIF read is now refused up front with an os-specific conversion command (sips / heif-convert / ImageMagick) so the unsupported format never reaches the provider (which would reject the whole session once it lands in history). The two guidance builders are ported verbatim from v1, and the check sits after the image-capability guard (using IHostEnvironment.osKind). Also give the existing EXIF-rotation test a longer timeout: it does heavy jimp encode/decode and was flaking around the default 5s boundary. * feat(agent-core-v2): wire startBtw into the agent RPC API Align with v1: expose `startBtw` on AgentAPI and delegate it to the existing ISessionBtwService (already implemented and DI-registered as SessionBtwService), so the /btw slash command can fork a side-question child agent once the server runs on v2. * chore(agent-core-v2): tidy misplaced and throwaway test files - Remove resume-debug.test.ts: a one-off diagnosis script with a hardcoded local path, not a real test. - Move streamTiming.test.ts to app/model/modelImpl.test.ts: it only exercises buildStreamTiming in app/model/modelImpl.ts. - Rename wire/store.test.ts to wire/wireServiceImpl.test.ts to match the module it covers (there is no store.ts in src). * fix(agent-core-v2): restore JSON Schema format validation in tool-args Align with v1: replace the hand-rolled subset validator with v1's Ajv- based implementation (draft-07/2019/2020 + ajv-formats), so tool-call argument validation once again honors the JSON Schema `format` keyword (and the full keyword set), not just the previously hard-coded subset. - args-validator.ts is now byte-identical to v1 (93 lines, replacing the 289-line hand-rolled subset). - Adds ajv@^8.18.0 and ajv-formats@^3.0.1 (same versions as v1) plus the pnpm-lock.yaml update. - The two call sites (compileToolArgsValidator -> validateToolArgs) keep working unchanged; a small test locks in format / required / additionalProperties / subset behavior. * fix(agent-core-v2): restore JSON Schema format validation in tool-args Align with v1: replace the hand-rolled subset validator with v1's Ajv- based implementation (draft-07/2019/2020 + ajv-formats), so tool-call argument validation once again honors the JSON Schema `format` keyword (and the full keyword set), not just the previously hard-coded subset. - args-validator.ts is now byte-identical to v1 (93 lines, replacing the 289-line hand-rolled subset). - Adds ajv@^8.18.0 and ajv-formats@^3.0.1 (same versions as v1) plus the pnpm-lock.yaml update. - The two call sites (compileToolArgsValidator -> validateToolArgs) keep working unchanged; a small test locks in format / required / additionalProperties / subset behavior. * chore(agent-core-v2): drop legacy 8-hex mention from CronDelete/CronList tool source Match the prompt change in 5cc8e520f: the CronDelete parameter description and invalid-id error now say "ULID" only (not "ULID or legacy 8-hex"), and the CronList id doc comment likewise. The validation regex is unchanged so loading any legacy 8-hex tasks from disk still works. * chore(agent-core-v2): remove resume-roundtrip test It round-tripped restore over a hardcoded local dataset (kimi-code-mini-bench/.vitest-results) that is not in the repo, so it vacuously passed everywhere else. Removed at the original author's request. * test(agent-core-v2): raise timeout for slow image-compress invariant test The fuzz-style invariant test now drives the full v1 fallback ladder ([2000, 1000, 768, 512, 384, 256]) for over-budget inputs, which takes longer than the default 5s boundary in this environment. Give it 30s. * chore(agent-core-v2): rename ambiguous test files - agent/task/manager.test.ts -> taskManager.test.ts (no manager.ts in agent/task; disambiguate from taskService.test.ts). - app/cron/persist.test.ts -> cronTaskPersistenceService.test.ts (mirrors the module it covers; agent/task/persist.test.ts mirrors agent/task/persist.ts, so it is left as-is). - agent/contextMemory/message.test.ts -> message-history.test.ts (its describe is 'message history (IAgentContextMemoryService)'; the dir already names the domain). * fix(agent-core-v2): preserve usage for aborted steps * fix(agent-core-v2): resume-safe session reads and in-memory transcript - sessionLifecycle: get/list no longer return a session whose cold resume is still in flight, so callers never observe a half-initialized handle; resume remains the way to await a fully restored handle - messageLegacy: reduce the transcript from the main agent's in-memory wire journal instead of re-reading wire.jsonl; AgentWireRecordService now keeps the journal current with live dispatch so cold and live sessions both read a consistent, full transcript * chore(agent-core-v2): drop stale micro-compaction references in comments micro-compaction only exists in legacy agent-core; v2 has no such mechanism. Update two comments that still cited it: - fullCompactionService: the real reason not to project here is that llmRequester already projects once. - swarmService: context.spliced consumers no longer include micro-compaction bookkeeping. * fix(agent-core-v2): report skill discovery diagnostics * test(agent-core-v2): align plan mode parity fixtures * fix: distinguish task output timeout from cancellation * chore: fix test name * fix(agent-core-v2): flush the wire persist queue before the record log Since d5e1d76fc every wire append rides the async persist queue whenever a blob service is registered, but AgentWireRecordService.flush() only awaited the log store. Callers - including the session-close path - could complete a flush while records were still in flight on the queue, and record-order assertions in tests raced it. Await the wire service flush, which drains the persist queue, before flushing the log. * test(agent-core-v2): align the goal reminder boundary test with the continuation driver The per-turn-boundary reminder test predates the goal continuation driver and never passed: its second explicit prompt raced the auto-launched continuation turn, which correctly holds the turn lane. Treat the continuation turn as the second boundary and end it deterministically by completing the goal through UpdateGoal, keeping the once-per-boundary (never per-step) assertion. * fix(agent-core-v2): stop goal turns gracefully when a hard budget is exhausted Previously a goal whose hard budget was reached mid-turn was only flipped to blocked while the turn kept running unbounded: the loop continues unconditionally after a tool-calls step, and steer flushes or Stop hooks could extend the turn indefinitely past the budget. Now, when the over-budget step requested tool calls, a goal_budget_stop system reminder is appended after the tool results telling the model the goal is blocked (resumable via /goal resume), to stop immediately, that further tool calls will be rejected, and to write a brief final status message. The model gets exactly one grace step, during which tool calls are answered with a soft rejection instead of executing. After the grace step - or when the over-budget step had no pending tool calls - a new AfterStepContext.stopTurn flag ends the turn, honored by the loop with precedence over tool_calls and hook-set continue so nothing can extend past the stop. The grace grant also respects maxStepsPerTurn so it can never turn a budget stop into a max-steps turn failure. Turn launch is gated as well: a prompt arriving while the active goal is already over budget (e.g. after resuming an exhausted goal) blocks the goal before the turn is marked goal-driven, so turnsUsed no longer drifts, no spurious goal_continued telemetry fires, and the prompt runs as an ordinary turn with the blocked-goal note injected. This deliberately diverges from agent-core v1, which hard-stops with zero grace and answers a prompt on an exhausted goal with a synthetic model-less turn: budget overshoot is now bounded at one closing step in exchange for consumed tool results and a user-facing wrap-up message. * fix(agent-loop): stop looping on bare tool_calls signal - remap tool_calls finishReason to 'other' when the provider emitted no tool call structure - prevents re-issuing the model call until maxSteps on a bare tool_calls signal - add loop test covering the v1 'unknown' turn-lifecycle behavior * fix(kap-server): emit legacy background.task.* alias on /api/v1 ws The v2 engine emits background-task lifecycle as `task.started` / `task.terminated`, but v1 consumers (kimi-code TUI / `kimi -p`, node-sdk) only handle `background.task.*` and silently dropped every task event when talking to server-v2, while kimi-web handles the native spelling and has the legacy one registered as known-but-unhandled. Fan the legacy spelling out next to the native event in SessionEventBroadcaster, reusing the same volatility so replay, journal and the per-agent filter stay coherent between the two. kimi-web keeps the native event and ignores the alias; the native /api/v2 stream is left unchanged. Add a SessionEventBroadcaster test asserting both spellings are emitted. * feat(agent-core-v2): port /init command from v1 - add Session-scope ISessionInitService that spawns the coder subagent, mirrors the run onto the main agent, reloads AGENTS.md and appends an init-variant system reminder, then flushes records - add SESSION_INIT_FAILED error code and register the sessionInit domain in the layer map, package index and DI dependency graph - drop the stale "flat (no subdirectories)" rule from the agent-core-dev skill * feat(api-v2): add klient SDK and reflection-based channel registry - replace per-method actionMap (resource:action) with a channel registry: each Service registers once by decorator id and all methods are invoked by reflection - routes move from /api/v2/:sa to /api/v2/:service/:method across HTTP routes and the WS protocol - add @moonshot-ai/klient: typed core/session/agent client over the HTTP channel that reuses agent-core-v2 service interfaces - register klient in flake.nix and pnpm-lock; refresh kap-server tests, e2e, and the apiSurface snapshot * refactor(agent-core-v2): drive turns by draining a StepRequest queue - add StepRequest / StepRequestQueue: the loop drains one batch per step, folding mergeable requests (steers) into the driver's step; a step that ran tools enqueues a ContinuationStepRequest, a plain message enqueues none, so the turn completes when the queue empties - replace AfterStepContext.continue with explicit enqueue; a failed step is retried by head-inserting its driver request - move prompt's private steer queue onto the loop via PromptStepRequest / SteerStepRequest / RetryStepRequest, which materialize their context messages at pop time (image-compression captions reroute to reminders on materialization) - goal and externalHooks orchestrate continuations by enqueueing requests instead of setting ctx.continue; a request's message only lands when the loop pops it, so skipped or aborted launches leave no orphan messages - remove the now-unused CancellationError - delete the reworked turn tests (turn.test.ts, turn-ready.test.ts) and the cron test suites * refactor(agent-core-v2): translate provider errors at the model boundary - add translateProviderError in app/protocol/errors and apply it once in ModelImpl.request: raw provider failures become coded KimiErrors with the raw error preserved as cause and HTTP fields in details; abort shapes pass through untouched - move provider-error mapping out of _base/errors/serialize so _base no longer imports llmProtocol; toErrorPayload/fromErrorPayload now round-trip cause chains recursively, capped at depth 8 - move context.overflow from LoopErrors to ProtocolErrors (wire code unchanged); move LoopError and the max-steps helpers into loop/loop.ts - consolidate isAbortError into _base/utils/abort, dropping the duplicates in retry, cloudTransport, and the question/subagent task tools - add unwrapErrorCause; classify retryability and HTTP status on the unwrapped cause in llmRequester and full-compaction - align task-notification tests with enqueue-only delivery: drain the loop queue with one turn and assert on task.notified instead of prompt steer - protocol: add recursive cause to KimiErrorPayload with a lazy zod schema * docs(agent-core-dev): add commit-align workflow, drop DI dependency map - add commit-align.md subskill: triage one main-branch commit against v2 (aligned / partial / missing / not-applicable) and link it from SKILL.md - delete docs/di-scope-domains.puml and the rendered svg, and drop the keep-the-map-in-sync requirement from verify.md, align.md, commit-align.md, and packages/agent-core-v2/AGENTS.md * refactor(agent-core-v2): move turn lifecycle into agent loop - make loop admission, cancellation, and completion own turn execution - extract step retry into a loop error recovery service - preserve failed-step context and expose retry delay events * refactor(agent-core-v2): centralize loop turn scheduling - add queued turn and step lifecycle handles with explicit admission modes - move continuation and retry scheduling behind the loop service - consolidate legacy prompt scheduling into the prompt domain - align kap-server routes and tests with the new loop contract * feat(klient): add WebSocket transport for calls and event streams - add WsSocket: persistent /api/v2/ws transport with hello handshake, heartbeat answers, per-call timeouts, and auto-reconnect that re-subscribes active listens; bearer token rides the kimi-code.bearer.<token> subprotocol for browser compatibility - add WsKlient / WsChannel exposing core/session/agent scopes and listen(event, handler) over the shared socket - add Klient#ws() lazy singleton with WebSocketImpl injection - bind global fetch in HttpChannel to avoid "Illegal invocation" in browsers * refactor(agent-core-v2): unify hook names to on{Will,Did}Xxx convention - loop: beforeStep -> onWillBeginStep, afterStep -> onDidFinishStep - toolExecutor: onWillExecuteTool -> onBeforeExecuteTool (ToolWillExecuteContext -> ToolBeforeExecuteContext) - prompt: onWillSubmitPrompt -> onBeforeSubmitPrompt - permissionMode: onChanged -> onDidChangeMode - wireRecord: onRestoredRecord -> onDidRestoreRecord, onResumeEnded -> onDidFinishResume - terminal: onData -> onProcessData, onExit -> onProcessExit * feat(kap-server): synchronously refresh all providers before listing models - GET /api/v1/models now awaits refreshProviderModels({ scope: 'all' }) before returning the model list, so the response always reflects the latest provider model metadata - refresh failures are logged and swallowed, falling back to the persisted catalog instead of failing the request * refactor(agent-core-v2): convert one-way notification hooks to Events Replace fire-and-forget OrderedHookSlot hooks with Emitter/Event-based notifications for consumers that only observe, never intercept: - usage: hooks.onDidRecord -> onDidRecord event - permissionMode: hooks.onDidChangeMode -> onDidChangeMode event - fullCompaction: hooks.onDidFinishCompaction -> onDidFinishCompaction event - wireRecord: hooks.onDidFinishResume -> onDidFinishResume event - agentLifecycle: hooks.onDidStopAgentTask -> onDidStopAgentTask event, announced via new notifyAgentTaskStopped() called by mirrorAgentRun Interception-capable slots (onWillStartAgentTask, onWillCompact, onDidRestoreRecord) stay as ordered hooks. * fix(agent-core-v2): route FetchURL through the Moonshot fetch service when logged in When the managed Kimi provider has an oauth ref, WebFetchService builds a MoonshotFetchURLProvider (bearer token + host identity headers) with the local fetcher as fallback, re-reading login state on every call; logged-out setups keep the local fetcher. * fix(agent-core-v2): forward host identity headers with WebSearch requests WebSearchProviderService now passes the host's IHostRequestHeaders (User-Agent + X-Msh-* device identity) as default headers to the Moonshot search provider, mirroring v1's kimiRequestHeaders. * fix(cli): seed host identity headers into the experimental v2 server The v2 boot path (kimi server run with the experimental flag) now seeds the CLI's Kimi identity headers (User-Agent + X-Msh-* device identity) into the engine through kap-server's seeds option, so outbound model, WebSearch, and FetchURL requests carry the same identity as direct CLI runs. kap-server's own package version is 0.0.0, so the identity has to come from the CLI. * feat: validate workspace roots and auto-launch task notification turns - task: idle terminal notifications now use activeOrNewTurn admission, launching their own turn instead of waiting for the next user prompt (matches v1 turn.steer) - workspaceRegistry: createOrTouch rejects missing or non-directory roots with fs.path_not_found, so a phantom cwd never reaches session creation - kap-server: map FS_PATH_NOT_FOUND to protocol error 40409 on the session and RPC surfaces - server-e2e: migrate the v2 smoke test from the local ServerClient to the typed Klient - misc: switch loop/prompt clear() iteration to .slice(), align terminal event handler names, and tidy klient examples * fix(kap-server): emit idle/aborted session status on turn end The v1 WS broadcaster only re-emitted event.session.status_changed(running) on turn.started and never emitted the idle/aborted transition on turn.ended. kimi-web treats that event as the single source of session status (its turn.ended projector deliberately does not synthesize idle), so a session stuck at 'running' after the turn finished — most visibly for background tasks, where ISessionActivity keeps reporting non-idle while the detached task lives and even a REST pull never corrected it. Re-emit event.session.status_changed after turn.ended on the same dispatch queue, mapping reason cancelled/failed/blocked to aborted and otherwise idle (previous_status 'running'), matching v1's _computeStatus. Update the broadcaster tests and harden the wsV1Resync test helper so non-matching frames no longer strand a waiter's timeout. * feat(ws): add Service event streaming with waitUntil handshake - listen messages accept a service name; kap-server resolves the Service via resolveService and subscribes through its onUpperCase member - add listen_result acknowledgement and per-listen error reporting (onDidListenError) so failed subscriptions surface to the client - support onWill-style events: payload carries eventId/signal/waitUntil, the client replies with event_result and the server can event_cancel - klient proxy maps onUpperCase members to channel.listen; WsChannel shares one remote subscription across first/last listeners - channel.call now forwards the complete argument array * feat(agent-core-v2): add typed telemetry event registry - register business telemetry events with compile-time property contracts - redact sensitive values and reject invalid cloud properties - centralize cloud appender construction and version context * feat(kap-server): add channel introspection endpoint - add describeChannels() to channelRegistry: scope derived from the scoped DI registry, public methods/getters enumerated from the prototype chain (framework plumbing and events excluded) - export ChannelDescriptor / ChannelMethodDescriptor from the contract - serve GET /api/v2/channels so clients (kimi-inspect) can render a dynamic service browser without handwritten method lists - cover with rpc test, e2e channel registry test, and API surface snapshot * feat(kap-server): expose declared parameter names in channel descriptors - add `params` field to ChannelMethodDescriptor, parsed from function source - extract declared parameter list via Function#toString with paren-depth tracking - cover param introspection in rpc and server-e2e channel registry tests * fix: adapt v2 print runner and tests to enqueue prompt API - run-v2-print: drive turns via IAgentPromptService.enqueue() and handle.launched; detect hook-blocked prompts via handle.completion; read the LoopRunResult type discriminator in formatNativeTurnFailure - bootstrap stubs: add clientVersion required by IBootstrapService - v2-run-print test: mock enqueue, stub IBootstrapService for createCloudAppender, add track2 to the telemetry stub - node-sdk test: cover prompt.completed/aborted/steered in the exhaustive event switch * feat(agent-core-v2): introduce graded error taxonomy for os, storage, and wire layers - add `os.fs.*` codes with `HostFsError` and the `toHostFsError` boundary translator - add `os.process.*`, `storage.*`, and `wire.*` domains with coded error classes - register new codes in the protocol `KimiErrorCode` union - translate raw OS and parse failures into domain codes across services, persistence backends, and kap-server transport - rename `KimiError` to `Error2` in the v2 base errors - remove obsolete kimi-csdk init example * test(agent-core-v2): wait for MCP connectAll instead of a fixed tick The MCP initial-connect assertion used a single setTimeout(0) tick, but connectAll is gated on Promise.all([resolveSessionMcpConfig(...), enabledMcpServers()]); the session-config side walks the real filesystem (project-root search + mcp.json reads), which does not settle within one macrotask under CI load. Use vi.waitFor so the test is robust on CI. * fix(minidb): publish WAL value pointers only after the frame is durable In valueMode 'disk' the write path installed a disk ValueLoc using the predicted WAL offset before the frame's bytes were flushed (appendLoc returns the offset synchronously; the writev lands on a later tick). Under load a concurrent compaction snapshot could read a pointer past the WAL end and fail with a short read. Apply the record as an in-memory ref first and only publish the disk pointer after appended.done resolves, guarded against WAL rotation and stale record seqs. * fix(kap-server): report missing agents as agent.not_found - resolveScope now throws Error2 for missing session/agent instead of returning undefined, distinguishing agent.not_found from session.not_found - map AGENT_NOT_FOUND onto the session-not-found protocol envelope for v1 parity * refactor(cli): gate print-mode v2 on KIMI_CODE_EXPERIMENTAL_FLAG - remove KIMI_PRINT_V2_ENV / isPrintV2Enabled and the dedicated KIMI_CODE_EXPERIMENT_FLAG switch - route `kimi -p` to the agent-core-v2 runner via isKimiV2Enabled, the same master switch that gates server-v2 * fix(agent-core-v2): map hostFs/storage error codes at server boundaries - unwrap the HostFsError cause before matching EISDIR in FileEditService, restoring the "is not a file" edit output broken by the error taxonomy - map os.fs.* codes to the closest v1 wire codes in the kap-server fs route and /api/v2 transport instead of collapsing to INTERNAL_ERROR - map storage.io_failed / storage.locked to PERSISTENCE_FAILURE in the /api/v2 transport * fix(agent-core-v2): serialize config writes and reloads A User-target set/replace mutates raw/rawSnake, awaits persist(), then rebuilds effective, while a reload() replaces all three wholesale from disk. Without serialization a reload whose file read resolves inside a write's persist window (before the atomic rename lands) restores the stale pre-write state, so the write's post-persist rebuild drops the just-written domain from effective. This surfaced as POST /config responses missing the field they had just written when the startup model-catalog refresh's reload() raced the write. Run User-target writes and reloads through a promise chain so they can no longer interleave. * feat(agent-core-v2): align telemetry with the v1 wire format - rename tool_call_dedupe_detected to tool_call_dedup_detected - emit turn_ended on every turn end; add mode/provider/protocol tags and interrupt_reason to turn_started/turn_interrupted - enrich api_error with alias, protocol tags, and input_tokens - tag tool_call with dup_type via an executor-side map (avoids the executor/dedupe DI cycle) - rename compaction usage fields to input_tokens/output_tokens - add context_projection_repaired, session_started, and session_load_failed events * feat(agent-core-v2): add lifecycle transition machine - add guarded synchronous and asynchronous state transitions - support commit, rollback, cleanup, and compensation actions - cover transition conflicts, action ordering, and failure aggregation * fix(agent-core-v2): harden plugin load, install, and update check paths - Degrade plugin consumption reads to empty when installed.json fails to load, surface plugin.load_failed with a repair hint on management calls, and recover after an explicit reload; serialize the initial load and mutations so concurrent first callers share one load. - Clean up zip temp dirs on every failure path, report the original source in zip/github manifest errors, and roll back to the previous managed copy when an install or persist fails. - Restore managed Kimi endpoint env injection for stdio plugin MCP servers. - Check plugin updates concurrently with per-repo failure isolation and 10s timeouts, track branch installs by commit SHA, and stop false update reports for tag/SHA pins. - Throw plugin.not_found from getPluginInfo and the manager's not-installed paths. - Count plugin skills through the real skill discovery path. - Re-sync context injection positions after silent wire replay so cold resumes do not duplicate injections, and fire plugin session-start reminders only when the plugin skill source finishes refreshing. * fix(agent-core-v2): use the v2 coded error type for plugins * fix(cli): align print session with background completion API * fix(kap-server): stabilize catalog and session status updates - keep model catalog reads free of provider refresh side effects - broadcast deduplicated session lifecycle and interaction statuses - cover catalog loops and global session status fan-out * test: stabilize CI integration cleanup --------- Co-authored-by: _Kerman <kermanx@qq.com> Co-authored-by: 7Sageer <7sageer@djwcb.cn> Co-authored-by: qer <wbxl2000@outlook.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Kaiyi <me@kaiyi.cool> Co-authored-by: Luyu Cheng <2239547+chengluyu@users.noreply.github.com> Co-authored-by: STAR-QUAKE <99738745+starquakee@users.noreply.github.com> Co-authored-by: fengchenchen <fengchenchen@moonshot.ai> Co-authored-by: liruifengv <liruifeng1024@gmail.com>	2026-07-12 21:44:04 +08:00