Feat/rust agent engine migration

.changeset/add-copy-command.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Add the /copy slash command to copy the last assistant message to the clipboard.

.changeset/btw-side-agent-command.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Add the /btw slash command to ask a forked side agent a question, and /endbtw to end it. Run /btw <question> to try it.

.changeset/calm-swarms-retry.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: Recover transient subagent rate limits without surfacing them as session errors.

.changeset/catalog-add-default-model.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Add a --default-model flag to kimi provider catalog add to persist the provider's default model. Pass --default-model <id> to set it.

.changeset/chinese-i18n-completion.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Add missing English translations for the Coding Plan configuration dialog and replace hardcoded strings across the TUI and CLI with proper i18n calls.

.changeset/cli-i18n-hardcoded.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/kimi-code": patch
+"@moonshot-ai/agent-core": patch
+---
+
+Replace hardcoded English strings in CLI command descriptions with proper i18n calls so `kimi --help` respects the configured locale. Fix locale propagation from the CLI shell to agent-core.

.changeset/configurable-bash-background-timeout.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Add `bash_task_timeout_s` config option under `[background]` to control the default background Bash task timeout. Set to `0` to disable the timeout entirely.

.changeset/curly-bikes-swim.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Integrate Rust native translation engine into the shared i18n package, with automatic fallback to pure JS when the native module is unavailable. Add createI18n() factory and translateBatch() to the kimi-code i18n module. Deprecate @moonshot-ai/i18n-shared/node.

.changeset/debug-rpc-surface.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Mount the dev-only /api/v1/debug RPC surface behind the --debug-endpoints flag, exposing every scoped service for local debugging on loopback binds. Pass --debug-endpoints to kimi server run to enable it.

.changeset/debug-zip-timestamped-filename.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix `/export-debug-zip` and `kimi export` overwriting the previous ZIP archive when run repeatedly on the same session; the default export filename now includes a timestamp.

.changeset/fix-astron-thinking-effort-levels.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix the thinking-effort picker only offering on/off for iFlytek Astron models that actually support effort levels; GLM-5.2 and DeepSeek-V4-Pro/Flash now offer High/Max.

.changeset/fix-goal-verifier-and-types.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix the goal completion verifier to handle verifier subagent failures gracefully, tighten verdict parsing for non-empty but unmarked results, and add the missing `created` goal change kind to wire protocol types.

.changeset/fix-i18n-locale-freeze.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix parts of the CLI (menus, hints, footer tips, and prompts) staying in English after selecting Chinese, caused by some translations being captured before the configured locale was applied.

.changeset/fix-i18n-locale-propagation.md

@@ -0,0 +1,7 @@
+---
+"@moonshot-ai/agent-core": patch
+"@moonshot-ai/kimi-code-sdk": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix locale propagation so agent-core messages match the TUI language, and fix Enter key in the experiments selector on Kitty-protocol terminals.

.changeset/fix-image-paste-rejection-exit.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix the CLI exiting unexpectedly when reading an image from the clipboard fails; it now falls back to pasting text.

.changeset/fix-native-build-injector-lookup.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix the native SEA build failing to locate the kimi-build injector, and include the rust-bin workspace package in Nix builds.

.changeset/fix-rejection-crash-telemetry.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Report crash telemetry for unhandled promise rejections.

.changeset/fix-rust-bin-platform-probing.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code-rust": patch
+---
+
+Fix the wrapper not finding binaries packed for linux-arm64, darwin-x64, and win32-arm64.

.changeset/fix-v2-version.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/agent-core-v2": patch
+---
+
+Fix `getCoreVersion()` to dynamically read the version from `package.json` instead of returning a hardcoded `'0.0.0'`.

.changeset/fix-web-open-url-auth.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix kimi web opening an unauthenticated page: the opened URL now carries the server token, and the wrapper hands the Rust binary the bundled web assets.

.changeset/fix-windows-workspace-duplicates.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: Fix duplicate workspace groups on Windows when the same folder is opened with different path spellings, such as a different drive-letter casing; all of the folder's sessions now list under the single merged group.

.changeset/i18n-agent-core.md

@@ -0,0 +1,5 @@
+---
+'@moonshot-ai/agent-core': minor
+---
+
+feat: add i18n support to agent-core with en/zh locale coverage for all user-facing strings

.changeset/i18n-shared-unification.md

@@ -0,0 +1,10 @@
+---
+"@moonshot-ai/i18n-shared": minor
+"@moonshot-ai/agent-core": patch
+"@moonshot-ai/kimi-code": patch
+"@moonshot-ai/kap-server": patch
+"@moonshot-ai/kimi-web": patch
+"kimi-code": patch
+---
+
+Add shared i18n package (`@moonshot-ai/i18n-shared`) with unified translation engine, locale detection, and type-safe key paths. Migrate all Node.js apps to the Rust-backed cached translator and browser apps to the shared pure-JS engine.

.changeset/mcp-security-hardening.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix project-level mcp.json discovery and harden MCP server connections: enforce OAuth state validation, restrict stdio environment inheritance to an allowlist, block bearer-token leakage to internal addresses, and cap tool result size.

.changeset/minidb-durability-hardening.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/minidb": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Harden the embedded key-value engine's durability: WAL compaction now always terminates under sustained write storms instead of chasing the tail forever, a committed write can no longer slip through a compaction rotation undetected, torn WAL tails no longer misplace later disk-mode value pointers, read-only opens never create or modify database files or compact under a live writer, corrupt index-definition files no longer force a full rebuild, stale compaction temp files are cleaned on open, and the process lock can no longer be taken over by several processes at once.

.changeset/minidb-perf-hardening.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/minidb": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Speed up the embedded key-value engine under stress: queries with skip/limit now stream candidates instead of decoding every match first, LRU eviction picks victims in O(1) instead of scanning every key, bursts of simultaneously expired TTL keys are drained within seconds, existence checks and size counting no longer read values when they only need metadata, and one oversized token can no longer poison the full-text index.

.changeset/minidb-reader-catchup.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/minidb": minor
+"@moonshot-ai/kimi-code": patch
+---
+
+Cluster readers of the embedded key-value engine now catch up incrementally by replaying only newly appended WAL frames after another process writes, instead of fully reopening the shard on every read; cross-process read latency drops by orders of magnitude at larger shard sizes, and readers still fall back to a full reopen after WAL rotation or truncation.

.changeset/minidb-review-hardening.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/minidb": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Keep the embedded key-value engine writable when a WAL compaction rotation fails mid-way instead of wedging it until reopen, stop a rolled-back write from erasing a concurrently committed value for the same key, let the RESP server survive aborted connections, recover after oversized requests, and answer each pipelined command independently, and keep the previous full-text index intact when a postings rebuild fails.

.changeset/misc-code-quality-fixes.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix a syntax error in the minidb query store test, prevent plugin directory leaks on removal, replace JSON-serialization of config records with structuredClone, close a registry-removal window in WebSocket connection teardown, add workspace path traversal guards in transcript reads, and route hook failures through the event bus instead of silent console output.

.changeset/moonshot-only-prompt-cache-key.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Stop sending the Moonshot-only prompt_cache_key field to other OpenAI-compatible providers, which rejected it with a 400 error and broke native-LLM turns.

.changeset/native-engine-event-stream.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix native engine sessions silently dropping their event stream after 512 events.

.changeset/portrait-image-orientation.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix portrait JPEGs compressed by the engine keeping their physical orientation.

.changeset/preserve-empty-reasoning.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Preserve empty model reasoning blocks across providers so multi-step tool calls can continue.

.changeset/record-interrupted-tool-calls.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Record and close tool calls interrupted mid-stream, preventing empty assistant messages that could wedge the session when the provider stream breaks off.

.changeset/require-goal-completion-criterion.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Enforce concrete completion criteria when creating goals. The model must now provide a verifiable check (at least 10 characters) before starting a goal; vague requests like "review the project" are rejected with a prompt to ask the user for specifics.

.changeset/rust-engine-default-everywhere.md

@@ -0,0 +1,22 @@
+---
+"@moonshot-ai/kimi-code": minor
+"@moonshot-ai/agent-core": patch
+"@moonshot-ai/kimi-agent": patch
+---
+
+Make the Rust agent engine the real default across every turn-running surface:
+
+- Wire the Rust engine into the interactive TUI (`runShell`) and the ACP server, matching the print-mode path — previously only `kimi -p` could use it.
+- Treat a missing `[agent]` config section as `engine = "rust"` on both the v1 and v2 paths, matching the schema default; `agent.engine = "js"` remains the opt-out.
+- Replace the silent JS fallbacks with diagnostic logs (adapter load failure, missing addon/binary) and export `getRustEngineMode()` from the rust-loop adapter; the TUI startup log now records the active engine.
+- Bring the Rust turn override to lifecycle parity with the JS loop. Host-proxy mode: `beforeStep` runs before every model step (compaction, steer-buffer flush, context injection — mid-turn steered messages previously never reached a Rust-driven turn; a blocking result fails the step) and `recordStepUsage`/`afterStep` record goal token accounting after every step. Native-LLM mode: per-step accounting hooks into the `llm.step.end` engine event instead, and steered messages land at continuation boundaries. `shouldContinueAfterStop` drives steer/Stop-hook/goal-outcome continuations on both paths by re-driving the engine with the remaining step budget.
+- Propagate turn cancellation into the Rust engine on **both transports**: the abort signal sets the engine's per-turn cancellation flag (stdio: `agent/cancel_turn` RPC; napi: the new `cancelTurnRust` export backed by a turn-id registry in `napi_bindings.rs`), checked before every Rust step — native-LLM turns included — and short-circuits the next host callback, mapping the result to stopReason `aborted`. A user interrupt therefore ends the turn as `cancelled` (goal pauses as interrupted) instead of `failed`. An in-flight provider request still finishes its current step before the flag takes effect.
+- Remove the stale `@moonshot-ai/server` workspace dependency that broke `pnpm install`.
+- Port the JS loop's request-recovery ladder into the Rust turn override (host-proxy path): HTTP 413 → media-degraded → media-stripped resend, image-format rejection → media-stripped resend, structural 400 → one-shot strict wire-compliant rebuild, with the media projection latched for later steps of the turn. Abnormal non-abort endings now also emit the `turn.interrupted` loop event with step detail.
+- **Security**: native Write/Edit execution no longer bypasses the host permission gate. Write-class tools now run the full host lifecycle from Rust — prepare (dedupe/PreToolUse) → authorize (permission policies + approval UI, with the same `Name(path)` session approval rule as the JS tools) → native execute → finalize (redaction) — admitted by a side-effect-free `claims_write` check so the host lifecycle never runs twice for one call. The napi bridge gained prepare/authorize/finalize ThreadsafeFunction channels (reusing the stdio transport's typed handlers), so both transports report `supports_tool_lifecycle` and take the gated native path; a transport without the channels falls back to full host execution instead of executing unapproved writes.
+- Native Bash for the standalone Rust agent path (`tools/bash.rs`): shell detection mirrors kaos (Git Bash on Windows via KIMI_SHELL_PATH/PATH/common installs; bash→sh probing on POSIX), foreground `-c` execution with the TS tool's noninteractive env, timeout kill (60s default / 300s cap), 50k/2k-per-line output caps, Windows cwd→POSIX and NUL-redirect rewrites, and the TS dangerous-command pattern table mapping to the `Bash(__dangerous__)` approval rule. Gated behind the same host prepare/authorize/finalize lifecycle as writes; off by default — host-driven paths keep the JS Bash (background tasks, detach, timeout-to-background are host-domain), the standalone agent opts in via `NativeToolset::with_shell`, and background runs always fall back to the host.
+- Standalone Rust goal driver (`Agent::run_prompt`): drives an active goal as continuation turns per the GOAL.md contract — Codex-derived skeleton with the tuned semantics. Continuation input renders from the canonical `continuation.md` steering template (single-source `include_str!` into `kimi-native-tools/src/goal/templates/`, carrying the tuned completion audit and 3-turn blocked audit), budgets hard-stop into `budgetLimited` at turn boundaries, aborts/failures pause the goal with interrupt/runtime semantics. The standalone `UpdateGoal` tool enforces the tuned contract: only `complete`/`blocked` are accepted, `complete` runs the independent completion verifier (a rejection keeps the goal active and tells the model to bring evidence), `blocked` records the streak for the audit trail. Turn overrides now receive the full interceptor chain (native tools → knowledge → MCP → goal) instead of the raw host callbacks.
+- Standalone session persistence and a working built-in loop: the `persistence/` module (SQLite session/record stores) is now mounted; `Agent::save_session`/`load_session` persist the context history and goal into the `SessionStore`, and restore applies the GOAL.md restart rule (an `active` goal comes back `paused`, resumable; `complete` is never restored; blocked/paused/budget states restore as-is). The built-in loop's LLM is now the real `HostLlmProxy` (the former `AgentLlm` stub errored on every chat) and `messages_to_loop_messages` actually projects context messages (text/image blocks, tool calls, tool-result linkage) instead of returning an empty history.
+- Phase-D session-owned agent surface: the stdio engine now exposes `session/create` / `session/prompt` / `session/cancel` / `session/save` / `session/load` / `session/list`, mounting the `session/` SessionManager module. The engine owns sessions, agents, goal driving (`session/prompt` runs the goal continuation driver), and persistence (`$KIMI_AGENT_HOME/sessions.db`, in-memory otherwise); the host installs `host/*` handlers and renders. `rust-loop.ts` gained the matching thin client (`sessionCreate`/`sessionPrompt`/… plus `installSessionHostHandlers`), `contract.ts` gained the wire types (`Session*Request/Response`, `SessionLifecycleEvent`), and the manager gained goal-aware `save_agent_session`/`load_agent_session` wrappers over `Agent::save_session`. The agent emits `session.turn.started` / `session.turn.ended` / `session.goal.updated` lifecycle events over the `host/event` channel so thin clients render without owning the loop. Fixed en route: the built-in loop passed the raw host callbacks instead of the interceptor chain, so goal/knowledge/MCP tools leaked to the host — caught by the end-to-end session smoke (goal tools now settle inside the engine, the canonical continuation steering demonstrably reaches the model, and a mid-flight `session/cancel` ends the prompt `Aborted` with the goal paused as interrupted).
+- Fix stdio binary discovery for the Cargo workspace layout: `findBinary` now also searches the repo-root `target/` directory and picks the most recently built candidate instead of silently preferring a stale per-crate build.
+- `kimi-agent session` CLI subcommands (list / resume / delete / current / export) run offline against the shared `$KIMI_AGENT_HOME/sessions.db` store and exit without starting the RPC server. Session persistence is now single-source: `save_agent_session` embeds the agent's durable state (context + goal) under `SessionRecord.agent_state` in the manager's own record (via `Agent::durable_state`/`restore_durable_state`) rather than writing a second record, so a session created over `session/*` RPC is visible to `session list`/`export` and vice versa.

.changeset/rust-native-engines.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Move goal-mode decision engine and permission rule DSL parser to Rust.

.changeset/rust-native-llm-tools-multimodal.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Rust engine: native LLM HTTP transport with SSE streaming (OpenAI-compatible and Anthropic, `agent.nativeLlmProvider`), in-process sandboxed execution of read-only tools Read/Grep/Glob (`agent.nativeTools`), and multimodal (text/image) message content blocks on the Rust wire. Adds a fire-and-forget `host/event` channel so streaming deltas, step boundaries, and natively-executed tool results are still recorded in the host transcript.

.changeset/rust-session-workdir-fixes.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix resumed sessions losing their workspace directory, Stop hanging during long-running commands, and config writes dropping the thinking/yolo sections.

.changeset/session-client-host-tools.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-agent": patch
+---
+
+Host-facing `createSessionClient`: the phase-D integration point for hosts (print mode, TUI). Hand the engine a step function and a tool table instead of running a turn loop — the engine owns the loop, context, goal driving, and persistence; the client returns a `{ prompt, cancel, save, load }` handle and renders from events. Host tools register at `session/create` (new `tools` param → `AgentOptions.host_tools`) and settle back at the host via `host/execute_tool`. Fixed en route: the standalone agent assembled its tool table (native + goal + MCP + knowledge) and then dropped it (`tool_defs: vec![]`), leaving the model blind to every tool — caught by the new stdio e2e test, which asserts the model actually sees `HostEcho`/`CreateGoal` and the host tool executes with the model's arguments. `KIMI_AGENT_FORCE_STDIO=1` skips the napi fast path for stdio-only surfaces.

.changeset/session-engine-controller.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Extract the session-owned engine integration into a reusable `SessionEngineController` (client factory + event/approval sinks, dependency-injected so the whole flow is unit-testable without a live engine), and adopt it in the `KIMI_SESSION_ENGINE=1` print pilot. The controller owns the engine `SessionClient`, translates engine wire events onto the SDK `Event` union, bridges the tool-approval gate onto a host yes/no prompt, and exposes an `onRawEvent` tap for engine-only signals the translator drops (e.g. `session.goal.updated`). This is the reusable seam for a future thin-client host; the interactive TUI deliberately stays on the proven `runTurnOverride` path (v1/v2), where Rust already drives turns and the override's `dispatchEvent` already emits the SDK events the TUI renders — no parallel TUI integration is introduced.