golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: drop 12 runtimes, keep Claude, Codex, OpenCode, Cursor, ZCode, Antigravity

Browse Source 
Removes kilo, kimi, kimi-code, copilot, windsurf, augment, trae, qwen, hermes,
cline, codebuddy and pi end to end: capability descriptors, installer branches
and converters (bin/install.js 14.9k -> 11.2k lines), TypeScript converters,
hook surfaces and runtime homes, review lanes qwen/kimi-code, the two pi
migrations, Kimi payload normalization in the hook guards, dead hostBehaviors
vocabulary, launcher home probes, fixtures, runtime-specific tests and the
prose that presented them as supported.

Installer output for the six kept runtimes is byte-identical to before the
prune. The Kimi tool-vocabulary tests in workflow-guard, read-guard and
read-injection-scanner are left in place pending a decision.
This commit is contained in:
Jakub Zych
2026-10-06 20:02:40 +02:00
parent 12ee75a509
commit 6cfa0c55d2
509 changed files with 1869 additions and 47737 deletions
Download Patch File Download Diff File Expand all files Collapse all files

102
hooks/msd-workflow-guard.js
View File

@@ -119,7 +119,7 @@ function payloadCwd(data) {
// The force-add block payload, emitted by the happy-path detector and the
// fail-closed catch — one source so the two exits cannot drift. `origin`
// distinguishes them structurally ('force-add-detected' vs 'fail-closed') so a
// consumer — or the model reading Kimi's stderr feedback — is never told a
// consumer — or the model reading stderr feedback — is never told a
// force-add was detected when the call was in fact blocked unanalyzed.
function emitForceAddBlock(origin) {
const failClosed = origin === 'fail-closed';
@@ -132,7 +132,7 @@ function emitForceAddBlock(origin) {
origin: failClosed ? 'fail-closed' : 'force-add-detected',
reason,
};
// Kimi CLI's exit-2 protocol feeds stderr back to the model (#2304) — deny's
// A native exit-2 hook bus may feed stderr back to the model (#2304) — deny's
// stderrPayload keeps fd 2 to the plain reason string, matching the
// pre-migration two-write byte-for-byte.
deny(output, output.reason);
@@ -151,7 +151,7 @@ function emitForceAddBlock(origin) {
function failClosedBlockContext(rawInput) {
let data;
try {
data = normalizeKimiPayload(JSON.parse(rawInput));
data = JSON.parse(rawInput);
} catch {
return false;
}
@@ -184,100 +184,6 @@ function workflowGuardEnabled(cwd) {
}
}
// Kimi CLI delivers the tool vocabulary the matcher was registered with —
// this guard's Kimi matcher is 'Shell|WriteFile|StrReplaceFile'
// (runtime-hooks-surface.cts), so tool_name arrives in Kimi vocabulary
// (possibly module-qualified) and neither the Bash branch nor the
// Write/Edit/MultiEdit allowlist below ever matched on Kimi (#2304).
// kimi-cli's Shell.Params names its field `command`
// (src/kimi_cli/tools/shell/__init__.py), same as Claude's Bash, so the
// Shell leg needs only the name mapping. This block is kept byte-identical
// with the copies in msd-prompt-guard.js, msd-read-guard.js,
// msd-worktree-path-guard.js, and msd-read-injection-scanner.js — a parity
// test binds them (tests/kimi-guard-normalization-parity.test.cjs). Inlined
// per guard (not hooks/lib/): hook scripts are staged as standalone files,
// and a sibling require is a staging dependency that can fail silently.
// A Map, not an object literal: bare bracket lookup resolves prototype keys
// ('constructor', '__proto__', 'toString') to truthy functions/objects, so the
// !mapped fall-through never fires for them; Map.get returns undefined (same
// shape as canonicalizeRuntimeName in src/runtime-name-policy.cts).
const KIMI_TOOL_NAMES = new Map([['WriteFile', 'Write'], ['StrReplaceFile', 'Edit'], ['ReadFile', 'Read'], ['Shell', 'Bash']]);
function normalizeKimiPayload(data) {
// #2595 (review nit): `JSON.parse('null')` is null, and null/primitive
// payloads reached the `data.tool_name` read below and threw — falsifying
// this function's own "total over the inputs JSON can express" claim, which
// property (e) now tests directly. Harmless in practice (a null payload has
// nothing to guard, and the throw landed in the same fail-open catch as the
// exit-0 it now takes deliberately) but the claim should be true as stated.
if (data === null || typeof data !== 'object') return data;
const raw = data.tool_name;
if (typeof raw !== 'string') return data;
const mapped = KIMI_TOOL_NAMES.get(raw.slice(raw.lastIndexOf(':') + 1));
if (!mapped) return data;
data.tool_name = mapped;
if (data.tool_response === undefined && data.tool_output !== undefined) {
data.tool_response = data.tool_output;
}
const input = data.tool_input;
if (input && typeof input === 'object') {
// #2547 (review): Kimi's `path` is AUTHORITATIVE — it must win outright,
// not merely fill in when `file_path` happens to be absent. kimi-cli's file
// tools carry no `file_path` field at all (src/kimi_cli/tools/file/write.py,
// replace.py, @ 4a550ef — the SHA #2547 pins), and soul/toolset.py hands the
// model's raw json-parsed
// arguments to PreToolUse verbatim, doing typed validation only later inside
// tool.call() — after the hook has already decided. So a `file_path` in a
// Kimi payload is ALWAYS model-supplied, and under the old `=== undefined`
// condition it SHADOWED the field kimi-cli actually executes on. A payload
// pairing a cross-root `path` with a spurious `file_path: ""` left every
// guard reading an empty string and exiting 0, while the identical write
// without the extra key blocked — a bypass needing no crash at all. The same
// shadowing also preserved a NON-STRING `file_path` (`[]`), which threw
// inside msd-worktree-path-guard's path.isAbsolute() and reached its outer
// `catch { process.exit(0) }`: the same crash-to-allow this fix closes
// elsewhere, reached through the guard's own read rather than through
// normalization. Overwriting can only ever narrow what a guard inspects to
// the path that will actually be written, so it cannot under-block.
if (typeof input.path === 'string') {
input.file_path = input.path;
}
const edits = Array.isArray(input.edit) ? input.edit
: (input.edit && typeof input.edit === 'object') ? [input.edit] : [];
if (edits.length) {
// #2547: `e?.old`, not `e.old` — `??` guards the value, not the
// dereference, so a NULLISH entry (`edit: [null]`) threw a TypeError
// here. normalizeKimiPayload runs before any tool dispatch, so that throw
// reached each guard's outer `catch { process.exit(0) }` and silently
// downgraded a should-BLOCK call into an allow. (A string/number entry
// never threw — `('x').old` is a legal read yielding undefined.)
//
// The String() coercion is guarded for the same reason: `{"toString":
// null}` is valid JSON that throws "Cannot convert object to primitive
// value", which is the identical crash-to-allow with a different
// trigger. Degrading only the non-coercible entry to '' keeps
// stringification intact for every value that CAN coerce (numbers,
// arrays, plain objects), so nothing downstream — including
// msd-prompt-guard's scan of new_string — loses content it saw before.
const editText = (v) => { try { return String(v ?? ''); } catch { return ''; } };
// #2595 (review Major 2): reconstruct UNCONDITIONALLY, mirroring the
// `path` decision above rather than merely filling in when the field
// happens to be absent. kimi-cli's StrReplaceFile schema is `path` +
// `edit` only (src/kimi_cli/tools/file/replace.py @ 4a550ef) — it carries
// no `old_string`/`new_string` at all, so either field appearing in a
// Kimi payload is ALWAYS model-supplied, exactly like `file_path`. Under
// the old `=== undefined` condition a model-supplied `new_string: ""`
// SHADOWED the reconstruction, leaving msd-prompt-guard's injection scan
// reading '' and exiting at its `if (!content)` before it ever saw the
// real `edit[].new` — a one-key bypass of the very scan this fix's
// guarded coercion exists to keep fed. A `typeof` test would NOT close
// it: a benign non-empty string shadows just as effectively as ''.
input.old_string = edits.map((e) => editText(e?.old)).join('\n');
input.new_string = edits.map((e) => editText(e?.new)).join('\n');
}
}
return data;
}
let input = '';
const stdinTimeout = setTimeout(() => allow(undefined), 3000);
process.stdin.setEncoding('utf8');
@@ -285,7 +191,7 @@ process.stdin.on('data', chunk => input += chunk);
process.stdin.on('end', () => {
clearTimeout(stdinTimeout);
try {
const data = normalizeKimiPayload(JSON.parse(input));
const data = JSON.parse(input);
// #3504 test-only fault seam: throws right after parse so the fail-closed
// posture of the outer catch is exercisable — no JSON-expressible input
// throws in this handler today (#2547/#2595 hardened every read). Gated on