ZacharyZhang-NY/Kigi-CLI
1
0
Fork 0
Code Issues Pull Requests Actions 13 Packages Projects Releases Wiki Activity

Compare commits

base: ZacharyZhang-NY/Kigi-CLI:9edb8729ef1f97f01a6b5741dae24aadd361f55a
Branches Tags
ZacharyZhang-NY/Kigi-CLI:main
ZacharyZhang-NY/Kigi-CLI:v0.1.11 ZacharyZhang-NY/Kigi-CLI:v0.1.10 ZacharyZhang-NY/Kigi-CLI:v0.1.9 ZacharyZhang-NY/Kigi-CLI:v0.1.8 ZacharyZhang-NY/Kigi-CLI:v0.1.7 ZacharyZhang-NY/Kigi-CLI:v0.1.6 ZacharyZhang-NY/Kigi-CLI:v0.1.5 ZacharyZhang-NY/Kigi-CLI:v0.1.4 ZacharyZhang-NY/Kigi-CLI:v0.1.3 ZacharyZhang-NY/Kigi-CLI:v0.1.2 ZacharyZhang-NY/Kigi-CLI:v0.1.1 ZacharyZhang-NY/Kigi-CLI:v0.1.0
...
compare: ZacharyZhang-NY/Kigi-CLI:v0.1.10
Branches Tags
ZacharyZhang-NY/Kigi-CLI:main
ZacharyZhang-NY/Kigi-CLI:v0.1.11 ZacharyZhang-NY/Kigi-CLI:v0.1.10 ZacharyZhang-NY/Kigi-CLI:v0.1.9 ZacharyZhang-NY/Kigi-CLI:v0.1.8 ZacharyZhang-NY/Kigi-CLI:v0.1.7 ZacharyZhang-NY/Kigi-CLI:v0.1.6 ZacharyZhang-NY/Kigi-CLI:v0.1.5 ZacharyZhang-NY/Kigi-CLI:v0.1.4 ZacharyZhang-NY/Kigi-CLI:v0.1.3 ZacharyZhang-NY/Kigi-CLI:v0.1.2 ZacharyZhang-NY/Kigi-CLI:v0.1.1 ZacharyZhang-NY/Kigi-CLI:v0.1.0
8 Commits
9edb8729ef ... v0.1.10
Author SHA1 Message Date
ZacharyZhang-NY 11c3ca9803 chore(release): bump workspace version to 0.1.10
Release / build (aarch64-apple-darwin) (push) Waiting to run
Details
Release / build (x86_64-apple-darwin) (push) Waiting to run
Details
Release / build (aarch64-unknown-linux-gnu) (push) Waiting to run
Details
Release / build (x86_64-pc-windows-msvc) (push) Waiting to run
Details
Release / publish GitHub Release (push) Blocked by required conditions
Details
Release / build (x86_64-unknown-linux-gnu) (push) Failing after 7s
Details 
All 62 crates inherit `workspace.package.version`, so the single edit
plus the refreshed lockfile carries the release. The `v0.1.10` tag is
what triggers the build; release.yml gates the tag against this value.

Also records the shared-SSRF-policy invariant in AGENTS.md, so a future
port does not reintroduce a second copy. The zero-egress entry is
compressed by the same number of lines to keep the file at 500.
 2026-07-27 13:26:25 -04:00
ZacharyZhang-NY bac8470c80 fix(hooks): share one SSRF policy instead of a second, stale copy 
The hook runner carried its own `is_blocked_ip`, a line-for-line copy of
the pre-hardening web_fetch predicate: loopback allowed unconditionally,
and no TEST-NET, 198.18/15, 240/4, 0.0.0.0/8, multicast, IPv6 site-local
or embedded-v4 wrapper coverage. Hook URLs come from settings, and
project settings from an untrusted repo are loaded today, so the gap is
reachable.

`kigi-hooks` already depends on `kigi-tools`, so the fix is to delete the
copy and call the shared predicate — no new crate, and no third
implementation to drift.

`allow_local` is on for hooks: a loopback hook receiver is a legitimate
local setup, which the old copy also allowed. It is now allowed only
when the URL names the host literally, so a public name resolving to
loopback is refused.

Range coverage now lives with the policy; the runner's tests pin what it
adds on top. The URL-scrubbing regression test moves off TEST-NET-1,
which the policy now blocks, onto a closed loopback port — faster, and
no real egress from a test.
 2026-07-27 13:01:50 -04:00
ZacharyZhang-NY 74402f3078 fix(pager): stop a sibling test flattening the diff-band assertion 
`committed_edit_keeps_diff_line_backgrounds` passed alone and
single-threaded but failed under parallel execution, so the workspace
gate was red.

`terminal_native_lock_paints_only_native_colors` engages the
process-global terminal-native lock. While it is held `Theme::current()`
returns `terminal_default()`, whose `diff_*_bg` are all `Color::Reset`,
so no band is painted at all — and `current_kind()` reports a nominal
`KigiNight`, which is what made the failure read as a theme mismatch.

Two changes, both at the cause:
- hold the shared theme lock via `theme_cache::pin_theme()`, the helper
  written for this and until now unused, so the lock cannot be engaged
  mid-test
- assert the invariant (two distinct non-Reset bands) instead of exact
  RGB: the entry line cache is keyed on the GLOBAL theme kind, so an
  exact-color assertion races by construction. Span-level colors stay
  pinned by the `tool::edit` tests that own them

The failure message now reports the theme, height, and the bands it
actually found, which is how the cause was located.
 2026-07-27 12:38:14 -04:00
ZacharyZhang-NY 649c5f5641 fix(models): drop the ultra reasoning effort, which no backend accepts 
The hardcoded Codex catalog advertised `ultra` for gpt-5.6-sol and
gpt-5.6-terra, so selecting it sent `reasoning.effort = "ultra"` and the
Responses endpoint answered 400 with its real menu, which ends at `max`.

The tier was kigi's invention: the enum documented it as codex-only, the
catalog was its only producer, and the upstream model snapshot never
listed it. Removing the variant as well as the catalog entries means
`/effort ultra` is rejected at the TUI instead of parsing and failing on
the wire; a persisted `ultra` degrades to the model default through
`lenient_reasoning_effort_opt`, as designed for vocabulary changes.
 2026-07-27 12:12:14 -04:00
ZacharyZhang-NY ad3840f9ec fix(web_fetch): block non-public targets by default and gate every hop 
kigi allowed loopback unconditionally and missed several non-public
ranges, and the SSRF check ran only on the initial URL.

Policy (ssrf.rs):
- loopback is blocked unless `[toolset.web_fetch] allow_local` (or
  KIGI_WEB_FETCH_ALLOW_LOCAL) is on, AND the URL names it explicitly,
  so a public name resolving to loopback stays blocked (DNS rebinding)
- add 0.0.0.0/8, 100.64/10, 192.0.0.0/24, TEST-NET-1/2/3, 198.18/15,
  240/4, IPv6 site-local and documentation prefixes
- inherit the IPv4 verdict through mapped, compatible, NAT64 and 6to4
  wrappers; network-specific NAT64 prefixes remain uncovered (see doc)

Plumbing (client.rs), where the exploitable half lived:
- re-check every redirect hop, not just the first
- compare hosts exactly; a `www` sibling has its own A records, so it
  is a cross-host redirect rather than an auto-followed hop
- run the check before the fetch service, so a blocked URL is never
  posted to an endpoint that egresses elsewhere
- exempt explicit local hosts from the https upgrade and from the
  single-label filter, and re-upgrade each followed hop

Wiring: allow_local reaches WebFetchParams from both construction
paths; documented in the config guide and the README env table.
 2026-07-27 11:44:20 -04:00
ZacharyZhang-NY ac23ebc9a1 feat(turn): halt a turn stuck repeating one identical tool call 
Ports grok-build's action stationarity breaker. A polling loop looks like
progress from inside the turn — every step succeeds — so nothing stops it
and it burns the whole budget re-reading one file. Nudge at 8 identical
batches, halt at 16, halt a pure no-op run at 4.

Three defects were found and fixed before this landed, none of which the
gates caught:

- The check runs AFTER execute_tool_calls, not before. Before it, the
  assistant's tool_calls are recorded with no results, so pushing the
  nudge triggers repair_dangling_tool_calls: synthetic "cancelled by the
  user" results get spliced in, the real results land after a user
  message, and dedup misses them — the orphan tool_result shape that
  draws a provider 400. It is Ok-gated too, since one `?` inside can
  leave a call resultless.
- `TurnOutcome::StationarityHalted` is its own variant grouped with
  Completed, not a reuse of Cancelled. As a cancellation it would report
  StopReason::Cancelled, fire the abort lifecycle, kill the turn's
  subagents, grow the goal harness back-off streak until three halts
  paused a running goal, and let completion-requirement recovery re-run
  the very turn halted for looping.
- The no-op gate is size-based, not name-based. kigi registers the shell
  tool as `run_terminal_cmd` and renames it `run_terminal_command`, so
  matching on "bash" silently disabled the tighter ceiling while every
  test still passed.
 2026-07-27 10:37:41 -04:00
ZacharyZhang-NY a07d889ad9 fix(swarm): label each member with its own item 
Every member was launched with the swarm's description, so the pager drew
N identical subagent blocks: the user could not tell which member was
running, and a failure could not be attributed to an item.

This is also why K6 does not port upstream's progress grid. A member IS
an ordinary subagent, so the pager already renders one block per member
with live status, duration, tool-call and turn counts — richer than a
grid cell. The gap was the label, not the widget; upstream's grid (and
the estimator behind it, which infers progress from tool-call rate)
answers a different TUI's shortcomings. The parent tool call already
reads "<description> (N members)" and `is_task_variant` already knows
`AgentSwarm`, so the blocking-wait spinner registers.
 2026-07-27 03:01:42 -04:00
ZacharyZhang-NY 16328e55f9 feat(swarm): /swarm mode — a standing instruction to fan work out 
The `agent_swarm` tool works with the mode off; what the mode adds is the
doctrine — decompose finely, give every member a disjoint scope, do not
do the work yourself. `/swarm`, `/swarm on|off`, `/swarm <task>`, gated
on the tool actually being in the toolset.

Two triggers, not upstream's three. Upstream's `tool` trigger exists so
invoking the tool makes the doctrine appear; kigi's tool carries its own
description and works with the mode off, so that trigger would add a
state only the tool can reach. `Manual` persists until switched off,
`Task` expires at turn end — both are real user intents.

Load-bearing decisions, each from a defect found in review:

- Expiry is a DROP guard, not a post-loop call. A user interrupt aborts
  the turn future rather than cancelling it, so post-loop code never
  runs; three `?` paths skip it too. Either way a `/swarm <task>` mode
  would leak into the next, unrelated prompt.
- `enter` is a total no-op while armed, so the `/swarm <task>` shorthand
  cannot downgrade a standing `/swarm on` into a per-turn mode that then
  disarms itself. This matches upstream; the first cut diverged, and the
  test asserting the divergence was inverted with the fix.
- An explicit `/swarm off` retracts UNCONDITIONALLY. The doctrine rides
  the conversation and so survives a resume, a fork and a compaction that
  an in-memory flag does not; trusting the flag left a session reading
  "off" with the instruction still steering and no way to clear it. That
  also retires the `reminder_live` field, whose doc comment claimed to
  know something the code cannot.
- The mode is deliberately NOT persisted, unlike /goal and /graph: those
  strand real work when lost, this is a prompt hint whose recovery is
  retyping one command. Recorded in AGENTS.md so the omission reads as a
  decision, not a gap.
- The pre-session gate is `subagents_enabled`, not a hardcoded `true`:
  the builder strips `agent_swarm` wherever it strips `task`, and
  advertising it then offers a menu entry that resolves to literal text.
- The exit reminder is as emphatic as the doctrine it revokes; a single
  weak clause is the likelier of the two to be summarised away.

The doctrine rides the existing `push_system_reminder` channel rather
than a second injection path of its own.
 2026-07-27 02:39:55 -04:00
43 changed files with 1566 additions and 391 deletions
Expand all files Collapse all files
AGENTS.md
+58 -8
View File
@@ -16,14 +16,14 @@ import) or any `KIMI_*` env var.
## Hard constraints
- **Zero egress**: outbound connections are limited to
`auth.kimi.com`, `api.kimi.com`, `api.moonshot.cn`, `api.moonshot.ai`,
GitHub Releases domains, user-configured MCP servers, the endpoints of
provider platforms the user has credentialed, and `models.dev` (model
metadata refresh — reached ONLY when an enabled platform's `/models` wire
lacks metadata, `wire_serves_metadata=false`; Kimi/Moonshot never trigger
it; `KIGI_MODELS_DEV_URL=0` disables). No telemetry, no analytics, ever.
`crates/codegen/kigi-env` is the single home of first-party endpoints.
- **Zero egress**: only `auth.kimi.com`, `api.kimi.com`, `api.moonshot.cn`,
`api.moonshot.ai`, GitHub Releases, user-configured MCP servers, credentialed
provider endpoints, and `models.dev` (metadata refresh, ONLY when an enabled
platform's `/models` lacks it — `wire_serves_metadata=false`, never
Kimi/Moonshot, `KIGI_MODELS_DEV_URL=0` disables). No telemetry, no analytics,
ever. `crates/codegen/kigi-env` is the single home of first-party endpoints.
- **One SSRF policy**: `ssrf::is_blocked_for_host` gates every model/settings
URL (`web_fetch` + hooks), per redirect hop. Never write a second copy.
- **Toolchain**: Rust 1.97.0 (rust-toolchain.toml), edition 2024.
- **Gates** (all must stay green):
`cargo check --workspace --all-targets`,
@@ -164,6 +164,56 @@ edges stay deterministic Rust. The harness appends a terminal
the replan cap; `{"ops": []}` is a respected free no-op; failures
degrade.
## Swarm (`agent_swarm` tool + `/swarm` mode)
Cheap, unstructured fan-out — the one thing `/graph` does not offer. One
`prompt_template` containing `{{item}}` is expanded over an `items` list
into up to `MAX_AGENT_SWARM_MEMBERS` (128) ordinary subagents, run to
completion, and returned as ONE aggregate. Ported from kimi-code; entirely
client-side, no backend surface.
- Engine (`kigi-tools/.../kigi/agent_swarm/`): `plan.rs` validates and
expands (every fault is reported BEFORE a member starts; expanded
prompts must be pairwise distinct), `schedule.rs` is the launch ramp as
pure arithmetic (5 immediate, then 1 per 700ms; capacity shrinks on a
provider rate limit and recovers after a quiet window;
`KIGI_AGENT_SWARM_MAX_CONCURRENCY` caps it and a malformed value is a
hard error), `run.rs` drives it against the EXISTING single-spawn
`SubagentBackend`, `tool.rs` is the tool.
- `SwarmMemberOutcome::Backgrounded` is load-bearing: a member that
outlives the 600s foreground budget is detached by the coordinator and
KEEPS RUNNING. It is never reported `Failed` and never offered for
resume — relaunching its item would put a second agent on the same
files. Members share the caller's tree with NO isolation; the
distinct-prompt rule is the only thing keeping them apart.
- `InFlightGuard` (run.rs) cancels live members when the runner's future
is dropped. Send-now cancels the turn WITHOUT cancelling subagents and
aborts the task; the dropped receivers read as "parent gone" and each
child re-attaches itself. There is no cooperative path to use instead —
`kigi_tool_runtime::Cancellation` is constructed nowhere.
- Both retries (`MAX_RATE_LIMIT_RETRIES`) and wall clock
(`MAX_SWARM_RUNTIME`) are bounded: the swarm blocks the caller's turn,
so every wait needs a ceiling. Stragglers at the deadline are reported
as still-running WITH their ids.
- `ToolKind::AgentSwarm` is its own variant because `TemplateRenderer`'s
`by_kind` map holds ONE tool name per kind — sharing `Task` would
silently redirect `${{ tools.by_kind.task }}` in other tools' prompts.
It gates exactly as `Task` does (`capability.rs`), and `builder.rs`
strips it wherever `task` is stripped. `MAX_SUBAGENT_DEPTH` stays 1:
upstream's unlimited nesting is a hazard, not a feature.
- `/swarm | /swarm on|off | /swarm <task>` (`BuiltinGate::Swarm` = the
tool is in the toolset) arms a doctrine reminder via the existing
`push_system_reminder`. Two triggers only: `Manual` persists until
switched off, `Task` auto-expires at turn end via `SwarmTurnGuard` — a
DROP guard, because a user interrupt aborts the turn future and never
reaches post-loop code. `enter` is a total no-op while armed so the
`/swarm <task>` shorthand cannot downgrade a standing `/swarm on`.
- The mode is deliberately NOT persisted (unlike `/goal` and `/graph`,
which strand real work if lost): it is a prompt hint whose recovery is
retyping one command. The injected doctrine IS durable, so an explicit
`/swarm off` retracts UNCONDITIONALLY — a resumed or compacted session
can read as "off" with the instruction still in context.
## Provider registry & API-key auth (post-0.1.3 expansion)
- The platform registry is compiled-in spec rows in `kigi-models`
Cargo.lock
Generated
+62 -62
View File
@@ -5442,7 +5442,7 @@ dependencies = [
[[package]]
name = "kigi-acp-lib"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"async-trait",
@@ -5456,7 +5456,7 @@ dependencies = [
[[package]]
name = "kigi-agent"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"chrono",
"dirs 6.0.0",
@@ -5486,7 +5486,7 @@ dependencies = [
[[package]]
name = "kigi-agent-lifecycle"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"async-trait",
"tokio",
@@ -5495,7 +5495,7 @@ dependencies = [
[[package]]
name = "kigi-auth"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"async-trait",
"http 1.4.2",
@@ -5508,7 +5508,7 @@ dependencies = [
[[package]]
name = "kigi-bin"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"clap",
@@ -5543,7 +5543,7 @@ dependencies = [
[[package]]
name = "kigi-chat-state"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"indexmap",
"kigi-compaction",
@@ -5560,7 +5560,7 @@ dependencies = [
[[package]]
name = "kigi-codebase-graph"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"ahash",
"clap",
@@ -5596,7 +5596,7 @@ dependencies = [
[[package]]
name = "kigi-compaction"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"async-trait",
@@ -5609,7 +5609,7 @@ dependencies = [
[[package]]
name = "kigi-config"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"base64",
"blake3",
@@ -5632,7 +5632,7 @@ dependencies = [
[[package]]
name = "kigi-config-types"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"indexmap",
@@ -5646,7 +5646,7 @@ dependencies = [
[[package]]
name = "kigi-crash-handler"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"backtrace",
"libc",
@@ -5657,7 +5657,7 @@ dependencies = [
[[package]]
name = "kigi-env"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"tracing",
"url",
@@ -5665,7 +5665,7 @@ dependencies = [
[[package]]
name = "kigi-fast-worktree"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"bytes",
@@ -5697,7 +5697,7 @@ dependencies = [
[[package]]
name = "kigi-file-utils"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"aws-config",
@@ -5721,7 +5721,7 @@ dependencies = [
[[package]]
name = "kigi-fsnotify"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"criterion",
"dunce",
@@ -5742,7 +5742,7 @@ dependencies = [
[[package]]
name = "kigi-gix-status"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"gix",
"kigi-test-utils",
@@ -5752,7 +5752,7 @@ dependencies = [
[[package]]
name = "kigi-hooks"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"fastrand",
"kigi-config",
@@ -5771,7 +5771,7 @@ dependencies = [
[[package]]
name = "kigi-hooks-plugins-types"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"serde",
"serde_json",
@@ -5779,7 +5779,7 @@ dependencies = [
[[package]]
name = "kigi-http"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"kigi-auth",
"kigi-log",
@@ -5794,7 +5794,7 @@ dependencies = [
[[package]]
name = "kigi-hunk-tracker"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"chrono",
"dunce",
@@ -5815,14 +5815,14 @@ dependencies = [
[[package]]
name = "kigi-interjection-core"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"serde",
]
[[package]]
name = "kigi-log"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"chrono",
@@ -5840,7 +5840,7 @@ dependencies = [
[[package]]
name = "kigi-markdown"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anstyle",
"anstyle-lossy",
@@ -5864,14 +5864,14 @@ dependencies = [
[[package]]
name = "kigi-markdown-core"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"pulldown-cmark",
]
[[package]]
name = "kigi-mcp"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"async-trait",
@@ -5908,7 +5908,7 @@ dependencies = [
[[package]]
name = "kigi-memory"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"arc-swap",
@@ -5942,7 +5942,7 @@ dependencies = [
[[package]]
name = "kigi-mermaid"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"fontdb",
"image",
@@ -5960,7 +5960,7 @@ dependencies = [
[[package]]
name = "kigi-models"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"kigi-env",
"serde",
@@ -5970,7 +5970,7 @@ dependencies = [
[[package]]
name = "kigi-pager-minimal"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"chrono",
"crossterm",
@@ -5987,7 +5987,7 @@ dependencies = [
[[package]]
name = "kigi-pager-pty-harness"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"alacritty_terminal",
"anyhow",
@@ -6012,7 +6012,7 @@ dependencies = [
[[package]]
name = "kigi-pager-render"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"anstyle",
@@ -6064,7 +6064,7 @@ dependencies = [
[[package]]
name = "kigi-paths"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"camino",
"serde",
@@ -6074,7 +6074,7 @@ dependencies = [
[[package]]
name = "kigi-prompt-queue"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"serde",
"serde_json",
@@ -6082,7 +6082,7 @@ dependencies = [
[[package]]
name = "kigi-proto-build"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"pbjson-build",
@@ -6093,7 +6093,7 @@ dependencies = [
[[package]]
name = "kigi-ratatui-inline"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"ansi-width",
"anstyle-parse 0.2.7",
@@ -6110,7 +6110,7 @@ dependencies = [
[[package]]
name = "kigi-ratatui-textarea"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"arboard",
"chrono",
@@ -6131,7 +6131,7 @@ dependencies = [
[[package]]
name = "kigi-sampler"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"async-openai",
"async-stream",
@@ -6154,7 +6154,7 @@ dependencies = [
[[package]]
name = "kigi-sampling-types"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"assert_matches",
"async-openai",
@@ -6171,7 +6171,7 @@ dependencies = [
[[package]]
name = "kigi-sandbox"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"chrono",
@@ -6192,7 +6192,7 @@ dependencies = [
[[package]]
name = "kigi-secrets"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"regex",
"serde_json",
@@ -6230,7 +6230,7 @@ dependencies = [
[[package]]
name = "kigi-shell"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"anyhow",
@@ -6367,7 +6367,7 @@ dependencies = [
[[package]]
name = "kigi-shell-base"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"chrono",
@@ -6392,7 +6392,7 @@ dependencies = [
[[package]]
name = "kigi-sqlite-journal"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"libc",
"rusqlite",
@@ -6403,7 +6403,7 @@ dependencies = [
[[package]]
name = "kigi-subagent-resolution"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"kigi-sampling-types",
"kigi-tool-types",
@@ -6418,7 +6418,7 @@ dependencies = [
[[package]]
name = "kigi-system-power"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"windows-sys 0.59.0",
"zbus",
@@ -6426,7 +6426,7 @@ dependencies = [
[[package]]
name = "kigi-test-support"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"anyhow",
@@ -6448,7 +6448,7 @@ dependencies = [
[[package]]
name = "kigi-test-utils"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"runfiles",
"tracing",
@@ -6457,11 +6457,11 @@ dependencies = [
[[package]]
name = "kigi-token-estimation"
version = "0.1.9"
version = "0.1.10"
[[package]]
name = "kigi-tool-protocol"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"kigi-tool-types",
"serde",
@@ -6472,7 +6472,7 @@ dependencies = [
[[package]]
name = "kigi-tool-runtime"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"async-trait",
@@ -6490,7 +6490,7 @@ dependencies = [
[[package]]
name = "kigi-tool-types"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"minijinja",
"schemars 1.2.1",
@@ -6500,7 +6500,7 @@ dependencies = [
[[package]]
name = "kigi-tools"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"arc-swap",
@@ -6577,7 +6577,7 @@ dependencies = [
[[package]]
name = "kigi-tools-api"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"kigi-proto-build",
"kigi-tool-protocol",
@@ -6590,11 +6590,11 @@ dependencies = [
[[package]]
name = "kigi-tracing-macros"
version = "0.1.9"
version = "0.1.10"
[[package]]
name = "kigi-tty-utils"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"libc",
"nix 0.30.1",
@@ -6604,7 +6604,7 @@ dependencies = [
[[package]]
name = "kigi-tui"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"ansi-to-tui",
@@ -6691,7 +6691,7 @@ dependencies = [
[[package]]
name = "kigi-update"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"dunce",
@@ -6720,14 +6720,14 @@ dependencies = [
[[package]]
name = "kigi-version"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"semver",
]
[[package]]
name = "kigi-workspace"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"agent-client-protocol",
"anyhow",
@@ -6806,7 +6806,7 @@ dependencies = [
[[package]]
name = "kigi-workspace-types"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"base64",
"chrono",
@@ -8840,7 +8840,7 @@ dependencies = [
[[package]]
name = "ptyctl"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"alacritty_terminal",
"anyhow",
@@ -8858,7 +8858,7 @@ dependencies = [
[[package]]
name = "ptyctl-cli"
version = "0.1.9"
version = "0.1.10"
dependencies = [
"anyhow",
"axum",
Cargo.toml
+1 -1
View File
@@ -76,7 +76,7 @@ members = [
]
[workspace.package]
version = "0.1.9"
version = "0.1.10"
edition = "2024"
license = "Apache-2.0"
crates/codegen/kigi-hooks/src/runner/http.rs
+56 -135
View File
@@ -26,68 +26,14 @@ struct HttpHookOutput {
reason: Option<String>,
}
/// CWE-918: Returns `true` if an IP address is in a private, link-local,
/// or cloud metadata range that should be blocked to prevent SSRF attacks.
/// CWE-918: whether this address is blocked for a hook.
///
/// Loopback (`127.x` / `::1`) is allowed for local development servers.
fn is_blocked_ip(ip: &IpAddr) -> bool {
match ip {
IpAddr::V4(v4) => {
let octets = v4.octets();
if octets[0] == 127 {
// loopback — allowed for local dev
return false;
}
if octets[0] == 10 {
// RFC 1918: 10.0.0.0/8
return true;
}
if octets[0] == 172 && (16..=31).contains(&octets[1]) {
// RFC 1918: 172.16.0.0/12
return true;
}
if octets[0] == 192 && octets[1] == 168 {
// RFC 1918: 192.168.0.0/16
return true;
}
if octets[0] == 169 && octets[1] == 254 {
// RFC 3927: 169.254.0.0/16 (link-local, cloud metadata)
return true;
}
if octets[0] == 100 && (64..=127).contains(&octets[1]) {
// RFC 6598: 100.64.0.0/10 (CGNAT)
return true;
}
if v4.is_unspecified() {
// 0.0.0.0
return true;
}
false
}
IpAddr::V6(v6) => {
if v6.is_loopback() {
// ::1 — allowed for local dev
return false;
}
if v6.is_unspecified() {
// ::
return true;
}
if let Some(v4) = v6.to_ipv4_mapped() {
return is_blocked_ip(&IpAddr::V4(v4));
}
let segments = v6.segments();
if segments[0] & 0xffc0 == 0xfe80 {
// fe80::/10 — link-local
return true;
}
if segments[0] & 0xfe00 == 0xfc00 {
// fc00::/7 — unique local (ULA)
return true;
}
false
}
}
/// Delegates to the `web_fetch` policy, so one implementation
/// governs every outbound URL. `allow_local` is on: a loopback hook
/// receiver is legitimate, but only when named literally, so
/// rebinding through a public name stays blocked.
fn is_blocked_ip(ip: &IpAddr, host: &str) -> bool {
kigi_tools::implementations::kigi::web_fetch::ssrf::is_blocked_for_host(ip, host, true)
}
/// CWE-918: Validate a hook URL to prevent SSRF.
@@ -112,7 +58,7 @@ async fn validate_hook_url(url: &str) -> Result<(), String> {
// If host is a literal IP, check it directly.
if let Ok(ip) = host.parse::<IpAddr>() {
if is_blocked_ip(&ip) {
if is_blocked_ip(&ip, host) {
return Err(format!("URL resolves to blocked private/internal IP: {ip}"));
}
return Ok(());
@@ -131,7 +77,7 @@ async fn validate_hook_url(url: &str) -> Result<(), String> {
}
for addr in &addrs {
if is_blocked_ip(&addr.ip()) {
if is_blocked_ip(&addr.ip(), host) {
return Err(format!(
"URL host {host} resolves to blocked private/internal IP: {}",
addr.ip()
@@ -571,76 +517,53 @@ mod tests {
}
}
// SSRF protection: is_blocked_ip tests
// SSRF protection: hook-side policy tests
//
// Range coverage lives with the shared predicate in `web_fetch::ssrf`;
// these pin what the runner adds on top.
/// Every range the shared policy knows is refused here.
#[test]
fn ssrf_blocks_rfc1918_10x() {
assert!(is_blocked_ip(&"10.0.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"10.255.255.255".parse().unwrap()));
fn ssrf_delegates_to_the_shared_policy() {
for ip in [
"10.0.0.1",
"172.16.0.1",
"192.168.0.1",
"169.254.169.254",
"100.64.0.1",
"0.0.0.0",
"::",
"fe80::1",
"fc00::1",
"::ffff:10.0.0.1",
// Ranges the old hand-rolled copy missed entirely.
"198.18.0.1",
"192.0.2.1",
"203.0.113.1",
"240.0.0.1",
"64:ff9b::a9fe:a9fe",
] {
let ip: IpAddr = ip.parse().unwrap();
assert!(is_blocked_ip(&ip, &ip.to_string()), "{ip}");
}
for ip in ["1.1.1.1", "8.8.8.8", "172.32.0.1", "100.63.0.1"] {
let ip: IpAddr = ip.parse().unwrap();
assert!(!is_blocked_ip(&ip, &ip.to_string()), "{ip}");
}
}
/// A local hook receiver stays reachable when named literally.
#[test]
fn ssrf_blocks_rfc1918_172x() {
assert!(is_blocked_ip(&"172.16.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"172.31.255.255".parse().unwrap()));
assert!(!is_blocked_ip(&"172.15.0.1".parse().unwrap()));
assert!(!is_blocked_ip(&"172.32.0.1".parse().unwrap()));
fn ssrf_allows_a_literal_loopback_hook_target() {
assert!(!is_blocked_ip(&"127.0.0.1".parse().unwrap(), "127.0.0.1"));
assert!(!is_blocked_ip(&"::1".parse().unwrap(), "localhost"));
}
/// A public name resolving to loopback is rebinding.
#[test]
fn ssrf_blocks_rfc1918_192168() {
assert!(is_blocked_ip(&"192.168.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"192.168.255.255".parse().unwrap()));
}
#[test]
fn ssrf_blocks_link_local_metadata() {
assert!(is_blocked_ip(&"169.254.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"169.254.169.254".parse().unwrap()));
}
#[test]
fn ssrf_blocks_cgnat() {
assert!(is_blocked_ip(&"100.64.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"100.127.255.255".parse().unwrap()));
assert!(!is_blocked_ip(&"100.63.0.1".parse().unwrap()));
}
#[test]
fn ssrf_blocks_unspecified() {
assert!(is_blocked_ip(&"0.0.0.0".parse().unwrap()));
assert!(is_blocked_ip(&"::".parse().unwrap()));
}
#[test]
fn ssrf_allows_loopback() {
assert!(!is_blocked_ip(&"127.0.0.1".parse().unwrap()));
assert!(!is_blocked_ip(&"::1".parse().unwrap()));
}
#[test]
fn ssrf_allows_public_ips() {
assert!(!is_blocked_ip(&"1.1.1.1".parse().unwrap()));
assert!(!is_blocked_ip(&"8.8.8.8".parse().unwrap()));
}
#[test]
fn ssrf_blocks_ipv6_link_local() {
assert!(is_blocked_ip(&"fe80::1".parse().unwrap()));
}
#[test]
fn ssrf_blocks_ipv6_unique_local() {
assert!(is_blocked_ip(&"fc00::1".parse().unwrap()));
assert!(is_blocked_ip(&"fd00::1".parse().unwrap()));
}
#[test]
fn ssrf_blocks_ipv4_mapped_ipv6_private() {
assert!(is_blocked_ip(&"::ffff:10.0.0.1".parse::<IpAddr>().unwrap()));
assert!(is_blocked_ip(
&"::ffff:192.168.1.1".parse::<IpAddr>().unwrap()
));
fn ssrf_blocks_a_public_name_that_resolves_to_loopback() {
let ip: IpAddr = "127.0.0.1".parse().unwrap();
assert!(is_blocked_ip(&ip, "evil.example.com"));
}
// SSRF protection: validate_hook_url tests
@@ -839,14 +762,15 @@ mod tests {
/// the secret does NOT appear in the returned error message.
#[tokio::test]
async fn run_http_hook_scrubs_url_from_reqwest_error() {
// Use a TEST-NET-1 host (RFC 5737, "MUST NOT be used in
// public networks"). It is not RFC1918 so SSRF validation
// will let it through, but no real DNS or connection will
// succeed -- reqwest will surface a connection error whose
// default Display includes the URL.
// A closed loopback port: allowed as a literal local host,
// and refused at once. TEST-NET-1 is now blocked by policy.
let dead = {
let l = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
l.local_addr().unwrap()
};
let secret = "ghp_VERY_REAL_SECRET_TOKEN_42";
let mut extra_env = std::collections::HashMap::new();
extra_env.insert("RUNTIME_HOST".to_string(), "192.0.2.1".to_string());
extra_env.insert("RUNTIME_HOST".to_string(), dead.to_string());
extra_env.insert("MY_TOKEN".to_string(), secret.to_string());
let raw = "https://${RUNTIME_HOST}/check?token=${MY_TOKEN}";
@@ -928,10 +852,7 @@ mod tests {
// debugging). The wire-DTO consumer must prefer raw_url for
// display -- documented in the HttpInfo rustdoc.
let info = info.expect("HttpInfo should be present for connection failures too");
assert_eq!(
info.url,
"https://192.0.2.1/check?token=ghp_VERY_REAL_SECRET_TOKEN_42"
);
assert_eq!(info.url, format!("https://{dead}/check?token={secret}"));
assert_eq!(info.raw_url.as_deref(), Some(raw));
}
crates/codegen/kigi-models/src/lib.rs
+6 -6
View File
@@ -1574,7 +1574,7 @@ impl PlatformId {
/// `models_cache.json`, the `visibility=="list"` AND `supported_in_api==true`
/// set) because OpenAI exposes no stable public models endpoint for the
/// ChatGPT Codex backend. Each entry carries context window + per-model
/// selectable reasoning efforts (incl. the codex-only `xhigh`/`max`/`ultra`
/// selectable reasoning efforts (incl. the codex-only `xhigh`/`max`
/// tiers), so the fetch path maps them through the SAME
/// `platform_wire_model_to_entry` output as a live listing — no new type.
pub fn hardcoded_catalog(self) -> Option<Vec<WireModel>> {
@@ -1617,13 +1617,13 @@ fn openai_codex_wire_models() -> Vec<WireModel> {
codex_wire_model(
"gpt-5.6-sol",
"GPT-5.6-Sol",
&["low", "medium", "high", "xhigh", "max", "ultra"],
&["low", "medium", "high", "xhigh", "max"],
"low",
),
codex_wire_model(
"gpt-5.6-terra",
"GPT-5.6-Terra",
&["low", "medium", "high", "xhigh", "max", "ultra"],
&["low", "medium", "high", "xhigh", "max"],
"medium",
),
codex_wire_model(
@@ -2655,7 +2655,7 @@ mod tests {
/// The HARDCODED openai-codex catalog is exactly the 4 supported+listed
/// models, keyed by slug, ctx 272000, each exposing its exact supported
/// efforts (incl. the codex-only `xhigh`/`max`/`ultra` tiers). The
/// efforts (incl. the codex-only `xhigh`/`max` tiers). The
/// list-but-broken / hidden models are absent. Every other platform serves
/// NO hardcoded catalog (its models come from the live wire).
#[test]
@@ -2702,11 +2702,11 @@ mod tests {
};
assert_eq!(
efforts("gpt-5.6-sol"),
["low", "medium", "high", "xhigh", "max", "ultra"]
["low", "medium", "high", "xhigh", "max"]
);
assert_eq!(
efforts("gpt-5.6-terra"),
["low", "medium", "high", "xhigh", "max", "ultra"]
["low", "medium", "high", "xhigh", "max"]
);
assert_eq!(
efforts("gpt-5.6-luna"),
crates/codegen/kigi-pager-minimal/src/commit.rs
+16 -11
View File
@@ -1251,6 +1251,10 @@ mod tests {
use ratatui::layout::Rect;
use similar::ChangeTag;
// A sibling test engages the terminal-native lock, which flattens
// every diff background process-wide. Hold the shared theme lock.
let _theme = kigi_tui::theme::cache::pin_theme();
let hunk = vec![
DiffLine {
text: "let x = 1;\n".into(),
@@ -1293,23 +1297,24 @@ mod tests {
// The committed edit uses a flat background (terminal transparency), but
// must still paint the per-line diff backgrounds — otherwise an added /
// removed line is indistinguishable from context.
let mut saw_insert = false;
let mut saw_delete = false;
//
// Theme-agnostic: the line cache is keyed on the global theme,
// so an exact-RGB match would race. Colors pinned in tool::edit.
let mut bands = std::collections::BTreeSet::new();
for y in 0..h {
for x in 0..width {
if let Some(cell) = buf.cell((x, y)) {
saw_insert |= cell.bg == theme.diff_insert_bg;
saw_delete |= cell.bg == theme.diff_delete_bg;
if let Some(cell) = buf.cell((x, y))
&& cell.bg != ratatui::style::Color::Reset
{
bands.insert(format!("{:?}", cell.bg));
}
}
}
assert!(
saw_insert,
"committed edit lost the insert (green) diff background"
);
assert!(
saw_delete,
"committed edit lost the delete (red) diff background"
bands.len() >= 2,
"committed edit lost its insert/delete diff bands: \
theme={:?} h={h} bands={bands:?}",
Theme::current_kind(),
);
}
crates/codegen/kigi-sampling-types/src/types.rs
+12 -36
View File
@@ -911,11 +911,6 @@ pub enum ReasoningEffort {
/// Messages both accept `xhigh` AND `max` as separate levels in 2026;
/// the Kimi wire spells its top tier `max` with no `xhigh`).
Max,
/// Codex-only top tier above `max` (the ChatGPT Codex backend exposes an
/// `ultra` reasoning effort on its flagship models). Reachable ONLY via a
/// model's server-declared effort menu (openai-codex); no built-in fallback
/// menu offers it, so other providers never emit it.
Ultra,
}
impl ReasoningEffort {
@@ -944,15 +939,12 @@ impl ReasoningEffort {
Self::High => "high",
Self::Xhigh => "xhigh",
Self::Max => "max",
Self::Ultra => "ultra",
}
}
/// Anthropic Messages API effort string; `None` for unsupported variants.
/// `xhigh` and `max` are distinct levels on the 2026 Messages API (both
/// appear in `GET /v1/models` `capabilities.effort`). `ultra` is codex-only
/// and never selected on an Anthropic model, but maps to its own string for
/// completeness (the Responses path writes effort via `as_str`, not this).
/// appear in `GET /v1/models` `capabilities.effort`).
pub fn to_messages_api(self) -> Option<&'static str> {
match self {
Self::None | Self::Minimal => None,
@@ -961,7 +953,6 @@ impl ReasoningEffort {
Self::High => Some("high"),
Self::Xhigh => Some("xhigh"),
Self::Max => Some("max"),
Self::Ultra => Some("ultra"),
}
}
}
@@ -984,9 +975,8 @@ impl std::str::FromStr for ReasoningEffort {
"high" => Ok(Self::High),
"xhigh" => Ok(Self::Xhigh),
"max" => Ok(Self::Max),
"ultra" => Ok(Self::Ultra),
_ => Err(format!(
"invalid reasoning effort: {s:?} (expected one of: none, minimal, low, medium, high, xhigh, max, ultra)"
"invalid reasoning effort: {s:?} (expected one of: none, minimal, low, medium, high, xhigh, max)"
)),
}
}
@@ -1878,30 +1868,16 @@ mod tests {
assert_eq!(ReasoningEffort::Max.to_messages_api(), Some("max"));
}
/// The codex-only `ultra` tier parses, serializes, and patches onto a
/// Responses body as `reasoning.effort = "ultra"` (the crux of surfacing a
/// codex model's full thinking menu). It is a DISTINCT level above `max`.
/// `ultra` is not a tier any backend accepts.
///
/// The Codex Responses endpoint rejects it with a 400 listing its menu,
/// which tops out at `max`. Parsing it would only send it again.
#[test]
fn reasoning_effort_ultra_is_a_distinct_codex_tier() {
assert_eq!(
"ultra".parse::<ReasoningEffort>().unwrap(),
ReasoningEffort::Ultra
);
assert_eq!(
"ULTRA".parse::<ReasoningEffort>().unwrap(),
ReasoningEffort::Ultra
);
assert_ne!(ReasoningEffort::Ultra, ReasoningEffort::Max);
assert_eq!(ReasoningEffort::Ultra.as_str(), "ultra");
let json = serde_json::to_string(&ReasoningEffort::Ultra).unwrap();
assert_eq!(json, "\"ultra\"");
assert_eq!(
serde_json::from_str::<ReasoningEffort>("\"ultra\"").unwrap(),
ReasoningEffort::Ultra
);
let mut body = serde_json::json!({ "model": "gpt-5.6-sol" });
patch_reasoning_effort(&mut body, Some(ReasoningEffort::Ultra));
assert_eq!(body["reasoning"]["effort"], "ultra");
fn reasoning_effort_ultra_is_not_a_tier() {
assert!("ultra".parse::<ReasoningEffort>().is_err());
assert!("ULTRA".parse::<ReasoningEffort>().is_err());
assert!(serde_json::from_str::<ReasoningEffort>("\"ultra\"").is_err());
assert_eq!(ReasoningEffort::Max.as_str(), "max");
}
/// The account id is decoded STATELESSLY from the bearer JWT payload's
@@ -2122,7 +2098,7 @@ mod tests {
);
let bad_type = as_map(serde_json::json!({"reasoningEffort": 3}));
assert_eq!(parse_reasoning_effort_meta(Some(&bad_type)), None);
// `ultra` is a real codex tier; a genuinely-unknown token still None.
// A genuinely-unknown token is dropped, not guessed at.
let unknown = as_map(serde_json::json!({"reasoningEffort": "MEGA"}));
assert_eq!(parse_reasoning_effort_meta(Some(&unknown)), None);
}
crates/codegen/kigi-shell/README.md
+2
View File
@@ -1309,6 +1309,7 @@ output_byte_limit = 65536 # max output size (64KB)
[toolset.web_fetch]
proxy_endpoint = "https://proxy.example.com" # egress proxy URL (all requests routed through it)
allowed_domains = ["docs.rs", "x.ai"] # override the built-in ~84-domain allowlist
allow_local = false # true = reach an explicit localhost / 127.0.0.0/8 / ::1 URL
[shortcuts]
send = ["Enter"]
@@ -2384,6 +2385,7 @@ The agent persists all session updates automatically. Clients can reconnect and
| `KIGI_AGENT` | Custom agent definition path or name (see [Agent Profiles](#agent-profiles)) |
| `KIGI_WEB_FETCH` | Enable (`1`) or disable (`0`) the `web_fetch` tool |
| `KIGI_WEB_FETCH_PROXY` | Egress proxy URL for `web_fetch` requests (overridden by `[toolset.web_fetch] proxy_endpoint`) |
| `KIGI_WEB_FETCH_ALLOW_LOCAL` | `1` lets `web_fetch` reach an explicit loopback URL; private and metadata ranges stay blocked |
| `KIGI_RESPECT_GITIGNORE` | Disable `.gitignore` filtering in tools when set to `0` |
| `KIGI_FEEDBACK_ENABLED` | Enable (`1`) or disable (`0`) feedback system independently from telemetry |
| `KIGI_DEPLOYMENT_KEY` | Management API key for enterprise deployments |
crates/codegen/kigi-shell/src/agent/models_fetch.rs
+4 -4
View File
@@ -1475,7 +1475,7 @@ mod tests {
/// short-circuits BEFORE any HTTP — there is NO mock `/models` server, yet
/// the fetch returns exactly the 4 compiled-in models keyed
/// `openai-codex/<slug>` on the Responses backend, ctx 272000, each exposing
/// its exact reasoning efforts (incl. the codex-only `xhigh`/`max`/`ultra`).
/// its exact reasoning efforts (incl. the codex-only `xhigh`/`max`).
/// A BOGUS base URL confirms no live `/models` request is attempted (it would
/// otherwise fail against an unroutable host).
#[tokio::test(flavor = "multi_thread")]
@@ -1556,10 +1556,10 @@ mod tests {
.iter()
.map(|o| o.id.as_str())
.collect::<Vec<_>>(),
vec!["low", "medium", "high", "xhigh", "max", "ultra"],
"sol exposes the full codex effort menu incl. ultra"
vec!["low", "medium", "high", "xhigh", "max"],
"sol exposes the full codex effort menu"
);
// gpt-5.5 tops out at xhigh (no max/ultra).
// gpt-5.5 tops out at xhigh (no max).
let five_five = result
.models
.iter()
crates/codegen/kigi-shell/src/agent/mvp_agent/agent_ops.rs
+5
View File
@@ -357,6 +357,11 @@ impl MvpAgent {
// time, so advertise pre-session; the in-session path
// re-checks the live toolset.
graph: goal && self.cfg.borrow().resolve_graph().value,
// Tool-dependent, so fail closed like every other tool gate: the
// builder strips `agent_swarm` whenever subagents are unavailable,
// and advertising it then offers a menu entry that resolves to
// literal prompt text.
swarm: self.cfg.borrow().subagents_enabled,
..crate::session::slash_commands::CommandAvailability::default()
}
}
crates/codegen/kigi-shell/src/agent/session_config.rs
-1
View File
@@ -60,7 +60,6 @@ fn effort_label(effort: ReasoningEffort) -> String {
ReasoningEffort::High => "High",
ReasoningEffort::Xhigh => "X-High",
ReasoningEffort::Max => "Max",
ReasoningEffort::Ultra => "Ultra",
}
.to_string()
}
crates/codegen/kigi-shell/src/session/acp_session.rs
+10
View File
@@ -121,6 +121,10 @@ mod model_switch;
mod prompt_queue;
#[path = "acp_session_impl/slash_exec.rs"]
mod slash_exec;
#[path = "acp_session_impl/stationarity_seam.rs"]
mod stationarity_seam;
#[path = "acp_session_impl/swarm.rs"]
mod swarm;
use super::PromptOrigin;
use super::acp_types;
use super::chat_persistence;
@@ -616,6 +620,9 @@ pub(crate) struct SessionActor {
/// layered over the goal engine. Modeled after `goal_tracker` above;
/// all graph state logic lives in `graph_tracker.rs`.
pub(crate) graph_tracker: Arc<parking_lot::Mutex<crate::session::graph_tracker::GraphTracker>>,
/// Swarm mode: a standing instruction to fan work out, independent of the
/// goal/graph engines — it steers tool choice, it does not drive turns.
pub(crate) swarm_mode: std::cell::Cell<crate::session::swarm_mode::SwarmMode>,
/// Max graph nodes running concurrently (1 = serial G0 behavior).
/// Cached at actor construction from `resolve_graph_concurrency`.
pub(crate) graph_concurrency: u32,
@@ -1033,6 +1040,9 @@ impl SessionActor {
// Graph rides the goal harness: nodes execute as goals, so
// `/graph` is only real when `/goal` is.
graph: self.graph_enabled && goal,
swarm: tool_names
.iter()
.any(|n| n == kigi_tools::implementations::kigi::AGENT_SWARM_TOOL_NAME),
}
}
/// Names of every tool registered with the session's tool bridge.
crates/codegen/kigi-shell/src/session/acp_session_impl/hook_dispatch.rs
+6 -1
View File
@@ -8,7 +8,12 @@ pub(super) fn turn_result_to_hook_outcome(
) -> kigi_tool_protocol::turn_hook::TurnHookOutcome {
use kigi_tool_protocol::turn_hook::TurnHookOutcome;
match result {
Ok(TurnOutcome::Completed { .. }) => TurnHookOutcome::Completed,
// A stationarity halt is a completed turn for hook purposes: nobody
// cancelled it, and a `Cancelled` outcome would tell every Stop hook
// the user interrupted the model.
Ok(TurnOutcome::Completed { .. }) | Ok(TurnOutcome::StationarityHalted { .. }) => {
TurnHookOutcome::Completed
}
Ok(TurnOutcome::Cancelled { .. }) | Ok(TurnOutcome::MaxTurnsReached { .. }) => {
TurnHookOutcome::Cancelled
}
crates/codegen/kigi-shell/src/session/acp_session_impl/slash_exec.rs
+30
View File
@@ -709,6 +709,36 @@ impl SessionActor {
BuiltinAction::GoalSet { .. } => {
unreachable!("GoalSet is intercepted in handle_prompt")
}
BuiltinAction::SwarmSet { enabled } => {
let msg = self.apply_swarm_mode(
enabled.then_some(crate::session::swarm_mode::SwarmTrigger::Manual),
);
self.send_slash_command_output(&msg).await;
ok_end_turn(0, None)
}
BuiltinAction::SwarmToggle => {
let turning_on = !self.swarm_mode.get().is_active();
let msg = self.apply_swarm_mode(
turning_on.then_some(crate::session::swarm_mode::SwarmTrigger::Manual),
);
self.send_slash_command_output(&msg).await;
ok_end_turn(0, None)
}
// `/swarm <task>` is handled before dispatch (it has to seed the
// turn with the task text); reaching here means the interception
// was bypassed, so report rather than silently dropping the task.
BuiltinAction::SwarmTask { prompt } => {
tracing::warn!(
prompt_len = prompt.len(),
"/swarm <task> reached the builtin executor; the turn seam did not intercept it"
);
self.send_slash_command_output(
"Could not start a swarm turn for that task. Run `/swarm on` and send the \
task as a normal message.",
)
.await;
ok_end_turn(0, None)
}
BuiltinAction::GoalStatus => {
let current_tokens = self.chat_state_handle.get_total_tokens().await as i64;
let goal_tokens = self.goal_tokens_used(current_tokens);
crates/codegen/kigi-shell/src/session/acp_session_impl/spawn.rs
+1
View File
@@ -1115,6 +1115,7 @@ pub(crate) async fn spawn_session_actor(
goal_tracker,
graph_enabled,
graph_tracker,
swarm_mode: std::cell::Cell::new(Default::default()),
graph_concurrency: effective_config.resolve_graph_concurrency(),
graph_node_rounds: effective_config.resolve_graph_node_rounds(),
graph_replan_cap: effective_config.resolve_graph_replan_cap(),
crates/codegen/kigi-shell/src/session/acp_session_impl/stationarity_seam.rs
+120
View File
@@ -0,0 +1,120 @@
//! Turn-loop seam for the stationarity detector.
use super::*;
use crate::session::stationarity::{
IdenticalToolCallRun, NUDGE_AFTER_IDENTICAL_TOOL_CALLS, command_is_true, hash_batch,
};
/// Sent once, naming the blocking wait a poller should use.
const STATIONARITY_NUDGE: &str = "\
You have called the same tool with the same arguments repeatedly and are in a \
polling loop. Stop repeating that call. If you are waiting on a background \
task, block on it with the wait-tasks tool instead of re-checking its output; \
if you are waiting on anything else, sleep once and check once. If you cannot \
make progress, stop and tell the user what you are waiting for. This turn will \
be halted automatically if the identical call keeps repeating.";
impl SessionActor {
/// Enforces the ceilings; `Some` halts the turn. Silent but logged.
pub(crate) async fn observe_tool_call_stationarity(
self: &Arc<Self>,
run: &mut IdenticalToolCallRun,
tool_calls: &[kigi_sampling_types::conversation::ToolCall],
loop_index: usize,
) -> Option<StationarityHalt> {
let batch_hash = hash_batch(
tool_calls
.iter()
.map(|tc| (tc.name.as_str(), tc.arguments.as_ref())),
);
let tool_name = tool_calls
.first()
.map(|tc| tc.name.clone())
.unwrap_or_default();
let is_true_noop = self.is_run_true_step(tool_calls).await;
let run_len = run.observe(batch_hash, &tool_name, is_true_noop);
if run_len == NUDGE_AFTER_IDENTICAL_TOOL_CALLS {
tracing::warn!(
tool_name = %run.tool_name(),
run_len,
loop_index,
"action stationarity: nudging a repeating tool call"
);
kigi_log::unified_log::warn(
"shell.turn.action_stationarity_nudge",
Some(self.session_info.id.0.as_ref()),
Some(serde_json::json!({
"tool_name": run.tool_name(),
"run_len": run_len,
"loop_index": loop_index,
})),
);
self.push_system_reminder(STATIONARITY_NUDGE);
}
if run_len < run.hard_stop_threshold() {
return None;
}
tracing::warn!(
tool_name = %run.tool_name(),
run_len,
loop_index,
true_noop = run.is_true_noop_run(),
"action stationarity: halting the turn"
);
kigi_log::unified_log::warn(
"shell.turn.action_stationarity_stop",
Some(self.session_info.id.0.as_ref()),
Some(serde_json::json!({
"tool_name": run.tool_name(),
"run_len": run_len,
"loop_index": loop_index,
"true_noop": run.is_true_noop_run(),
})),
);
Some(StationarityHalt {
tool_name: run.tool_name().to_string(),
run_len,
true_noop: run.is_true_noop_run(),
})
}
/// Whether this batch is a single shell call that does nothing.
///
/// Size-gated, not name-gated: the shell tool is renamed
/// `run_terminal_command`, so a name gate would silently disable this.
/// Parse failure fails open; multi-call batches use the ordinary ceiling.
async fn is_run_true_step(
&self,
tool_calls: &[kigi_sampling_types::conversation::ToolCall],
) -> bool {
/// Bound on `{"command":"true"}` plus sibling fields.
const MAX_NOOP_ARGS_BYTES: usize = 512;
let [tc] = tool_calls else {
return false;
};
if tc.arguments.as_ref().len() > MAX_NOOP_ARGS_BYTES {
return false;
}
let Ok(args) = serde_json::from_str::<serde_json::Value>(tc.arguments.as_ref()) else {
return false;
};
let Ok(input) = self.tool_bridge_handle().try_parse(&tc.name, args).await else {
return false;
};
matches!(
input,
kigi_tools::types::tool_io::ToolInput::Bash(ref b) if command_is_true(&b.command)
)
}
}
/// Why a turn was halted, carried to its outcome.
pub(crate) struct StationarityHalt {
pub(crate) tool_name: String,
pub(crate) run_len: u32,
pub(crate) true_noop: bool,
}
crates/codegen/kigi-shell/src/session/acp_session_impl/swarm.rs
+80
View File
@@ -0,0 +1,80 @@
//! Swarm-mode seam: arming/disarming the mode and the reminder it injects.
use super::*;
use crate::session::swarm_mode::{SWARM_ENTER_REMINDER, SWARM_EXIT_REMINDER, SwarmTrigger};
impl SessionActor {
/// Arms (`Some(trigger)`) or disarms (`None`) swarm mode, injecting or
/// retracting the doctrine exactly once, and returns the line to show.
pub(crate) fn apply_swarm_mode(self: &Arc<Self>, trigger: Option<SwarmTrigger>) -> String {
let mut mode = self.swarm_mode.get();
let message = match trigger {
Some(trigger) => {
if mode.enter(trigger) {
self.inject_swarm_reminder(SWARM_ENTER_REMINDER);
}
"Swarm mode on: work will be split across a fleet of subagents. \
`/swarm off` to stop."
}
None => {
// Unconditional, unlike the automatic expiry: the doctrine
// rides the conversation and therefore survives a resume, a
// fork and a compaction that the in-memory flag does not. If
// the user explicitly asks for it off, the retraction has to
// reach the model even when this session never saw it armed.
mode.exit();
self.inject_swarm_reminder(SWARM_EXIT_REMINDER);
"Swarm mode off."
}
};
self.swarm_mode.set(mode);
message.to_string()
}
/// A turn-scoped guard that disarms a per-turn swarm mode however the turn
/// ends.
///
/// The post-loop call site is not enough: a user interrupt ABORTS the turn
/// future (`cancel_running_task` → `JoinHandle::abort`), dropping it at its
/// current await point, and several `?` paths return before the loop's end.
/// Each of those leaks a `/swarm <task>` mode into the user's next,
/// unrelated prompt. The goal engine hit the same class and compensates
/// inside the cancel path; a guard is the version that cannot be forgotten
/// at a new exit.
pub(crate) fn swarm_turn_guard(self: &Arc<Self>) -> SwarmTurnGuard {
SwarmTurnGuard {
session: self.clone(),
}
}
/// Disarms at a turn boundary when the trigger was per-turn.
pub(crate) fn expire_swarm_mode_at_turn_end(self: &Arc<Self>) {
if !self.swarm_mode.get().expires_at_turn_end() {
return;
}
let mut mode = self.swarm_mode.get();
if mode.exit() {
self.inject_swarm_reminder(SWARM_EXIT_REMINDER);
}
self.swarm_mode.set(mode);
}
/// The doctrine rides the session's existing `<system-reminder>` channel,
/// so it is tagged the same way every other reminder is and needs no
/// second injection path of its own.
fn inject_swarm_reminder(self: &Arc<Self>, text: &str) {
self.push_system_reminder(text);
}
}
/// Runs [`SessionActor::expire_swarm_mode_at_turn_end`] on every turn exit,
/// including an aborted future.
pub(crate) struct SwarmTurnGuard {
session: Arc<SessionActor>,
}
impl Drop for SwarmTurnGuard {
fn drop(&mut self) {
self.session.expire_swarm_mode_at_turn_end();
}
}
crates/codegen/kigi-shell/src/session/acp_session_impl/turn.rs
+75 -4
View File
@@ -217,6 +217,10 @@ impl SessionActor {
persist_ack: Option<oneshot::Sender<()>>,
) -> PromptTurnResult {
let handle_prompt_start = std::time::Instant::now();
// Armed before anything can arm swarm mode, so a `/swarm <task>` mode
// is disarmed on EVERY exit from this turn — including the abort a
// user interrupt performs, which never reaches post-loop code.
let _swarm_turn_guard = self.swarm_turn_guard();
let prompt_length: usize = prompt_blocks
.iter()
.map(|b| match b {
@@ -301,6 +305,13 @@ impl SessionActor {
span.record("command_source", "builtin");
}
match action {
// `/swarm <task>` arms the mode for this turn only and
// sends the task as the prompt, so the doctrine is in the
// conversation before the model reads the work.
BuiltinAction::SwarmTask { prompt } => {
self.apply_swarm_mode(Some(crate::session::swarm_mode::SwarmTrigger::Task));
vec![text_block(prompt)]
}
BuiltinAction::GoalSet {
objective,
token_budget,
@@ -779,7 +790,7 @@ impl SessionActor {
let turn_tool_count = self.events.tool_count_this_turn();
let bridge_outcome = turn_result_to_hook_outcome(&result);
match &result {
Ok(TurnOutcome::Completed { .. }) => {
Ok(TurnOutcome::Completed { .. }) | Ok(TurnOutcome::StationarityHalted { .. }) => {
self.emit_turn_ended(
crate::session::events::TurnOutcomeLabel::Completed,
None,
@@ -869,7 +880,9 @@ impl SessionActor {
let doom_tally = std::mem::take(&mut *self.doom_loop_turn_tally.lock());
doom_tally.fired();
let stop_reason_str = match &result {
Ok(TurnOutcome::Completed { .. }) => "end_turn",
Ok(TurnOutcome::Completed { .. }) | Ok(TurnOutcome::StationarityHalted { .. }) => {
"end_turn"
}
Ok(TurnOutcome::Cancelled { .. }) | Ok(TurnOutcome::MaxTurnsReached { .. }) => {
"cancelled"
}
@@ -885,7 +898,7 @@ impl SessionActor {
)
.await;
match &result {
Ok(TurnOutcome::Completed { .. }) => {
Ok(TurnOutcome::Completed { .. }) | Ok(TurnOutcome::StationarityHalted { .. }) => {
for contributor in self.extension_registry.turn_lifecycle_contributors() {
contributor
.on_turn_done(&kigi_agent_lifecycle::TurnDoneInput)
@@ -970,6 +983,26 @@ impl SessionActor {
PromptCompletionKind::MaxTurnsReached { limit },
None,
),
// `EndTurn`, not `Cancelled`: the client must not render
// an interrupted turn for something nobody interrupted.
// The halt's detail rides `completion_kind`, which is
// where a bug report can still read it.
TurnOutcome::StationarityHalted {
snapshot,
tool_name,
run_len,
true_noop,
..
} => (
acp::StopReason::EndTurn,
*snapshot,
PromptCompletionKind::StationarityHalted {
tool_name,
run_len,
true_noop,
},
None,
),
};
if let Some(snapshot) = snapshot.as_mut() {
self.apply_prompt_modes_to_snapshot(snapshot);
@@ -1271,7 +1304,11 @@ impl SessionActor {
let mut result = self
.process_conversation_turn(req_id, json_schema.clone())
.await;
if matches!(result, Ok(TurnOutcome::MaxTurnsReached { .. })) {
// Harness stopped the turn; retrying re-enters the same wall.
if matches!(
result,
Ok(TurnOutcome::MaxTurnsReached { .. }) | Ok(TurnOutcome::StationarityHalted { .. })
) {
return result;
}
if let Ok(TurnOutcome::Completed {
@@ -1588,6 +1625,10 @@ impl SessionActor {
self.record_turn_model().await;
let mut metrics_drop_guard = TurnMetrics::new();
let mut turn_tools_called: Vec<String> = Vec::new();
let mut identical_tool_calls =
crate::session::stationarity::IdenticalToolCallRun::default();
// Retained across execute: observed only after results land.
let mut last_batch: Vec<kigi_sampling_types::conversation::ToolCall> = Vec::new();
let mut tool_turn_count: usize = 1;
let mut loop_index: u32 = 0;
let mut todo_gate_fires: u32 = 0;
@@ -2004,6 +2045,8 @@ impl SessionActor {
}
turn_tools_called.push(tc.name.clone());
}
last_batch.clear();
last_batch.extend(tool_calls.iter().cloned());
let tool_call_responses: Vec<ToolCallResponse> = tool_calls
.into_iter()
.map(|tc| ToolCallResponse {
@@ -2046,6 +2089,34 @@ impl SessionActor {
}
_ => {}
}
// After execute: every call has a result, so nothing dangles
// and the nudge cannot trigger the "cancelled" repair.
// Ok-gated: one `?` inside can leave a call resultless.
if execute_tool_calls_result.is_ok()
&& let Some(halt) = self
.observe_tool_call_stationarity(
&mut identical_tool_calls,
&last_batch,
tool_turn_count,
)
.await
{
let snapshot = self
.finalize_turn_bookkeeping(
req_id,
conv_turn_start,
&turn_span_totals,
model_fingerprint.clone(),
)
.await;
return Ok(TurnOutcome::StationarityHalted {
snapshot: Box::new(snapshot),
tools_called: std::mem::take(&mut turn_tools_called),
tool_name: halt.tool_name,
run_len: halt.run_len,
true_noop: halt.true_noop,
});
}
let next_turn = tool_turn_count + 1;
if let Some(limit) = self.max_turns
&& next_turn > limit
crates/codegen/kigi-shell/src/session/acp_session_impl/types.rs
+13
View File
@@ -62,6 +62,19 @@ pub(crate) enum TurnOutcome {
},
/// The `--max-turns` limit was reached after a tool-execution cycle.
MaxTurnsReached { limit: usize },
/// One tool call repeated past its ceiling; the turn was halted.
///
/// Groups with [`Self::Completed`], NOT [`Self::Cancelled`]: nobody
/// cancelled anything. As a cancellation it would report
/// `StopReason::Cancelled`, fire the abort lifecycle, kill the turn's
/// subagents, grow the goal back-off streak, and let recovery re-run it.
StationarityHalted {
snapshot: Box<Option<TurnDeltaSnapshot>>,
tools_called: Vec<String>,
tool_name: String,
run_len: u32,
true_noop: bool,
},
}
#[derive(Debug)]
crates/codegen/kigi-shell/src/session/acp_session_tests/cancel_running_task_tests.rs
+4
View File
@@ -106,6 +106,7 @@ async fn persist_ack_waits_for_disk_flush_before_success() {
tokio_util::sync::CancellationToken::new(),
);
let actor = Arc::new(SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info,
auth_method_id: test_auth_method_id("test-auth"),
model_auth_facts: std::cell::RefCell::new(None),
@@ -559,6 +560,7 @@ async fn first_turn_memory_injection_disabled_does_not_persist_to_chat_history()
};
let (event_tx, _event_rx) = tokio::sync::mpsc::unbounded_channel::<SessionEvent>();
let actor = Arc::new(SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: session_info.clone(),
auth_method_id: test_auth_method_id("test-auth"),
model_auth_facts: std::cell::RefCell::new(None),
@@ -820,6 +822,7 @@ async fn cancel_running_task_teardown_clears_running_and_pending_work() {
)
.await;
let actor = SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-cancel"),
cwd: cwd.as_str().to_string(),
@@ -1813,6 +1816,7 @@ async fn cancel_propagates_to_sampler_handle_so_no_further_emission() {
)
.await;
let actor = SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-cancel-sampler"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/acp_session_tests/idle_resume_tests.rs
+1
View File
@@ -115,6 +115,7 @@ async fn test_e2e_idle_resume_refreshes_model_metadata() {
});
tokio::time::sleep(std::time::Duration::from_millis(50)).await;
let actor = SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-idle-resume"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/acp_session_tests/inline_auto_compact_flow_tests.rs
+3
View File
@@ -64,6 +64,7 @@ async fn create_test_actor(
);
chat_state_handle.record_token_usage(total_tokens);
SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-auto-compact"),
cwd: cwd.as_str().to_string(),
@@ -493,6 +494,7 @@ async fn create_test_actor_with_memory(
.as_ref()
.map_or_else(Default::default, |mc| mc.initial_injection.clone());
SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-memory"),
cwd: cwd.as_str().to_string(),
@@ -1235,6 +1237,7 @@ async fn test_e2e_idle_resume_refreshes_model_metadata() {
});
tokio::time::sleep(std::time::Duration::from_millis(50)).await;
let actor = SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-idle-resume"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/acp_session_tests/memory_config_tests.rs
+1
View File
@@ -119,6 +119,7 @@ async fn create_test_actor_with_memory(
.as_ref()
.map_or_else(Default::default, |mc| mc.initial_injection.clone());
SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-memory"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/acp_session_tests/replay_buffer_send_update_tests.rs
+1
View File
@@ -72,6 +72,7 @@ pub(super) async fn make_replay_send_update_fixture() -> ReplaySendUpdateFixture
});
let (event_tx, event_rx) = mpsc::unbounded_channel::<SessionEvent>();
let actor = SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-session"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/acp_session_tests/support.rs
+1
View File
@@ -182,6 +182,7 @@ pub(crate) async fn create_test_actor_ex(
chat_state_handle.record_token_usage(total_tokens);
let (goal_update_tx, goal_update_rx) = tokio::sync::mpsc::unbounded_channel();
let actor = SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-actor"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/commands.rs
+7
View File
@@ -29,6 +29,13 @@ pub enum PromptCompletionKind {
MaxTurnsReached {
limit: usize,
},
/// One tool call repeated past its ceiling. Reported as `EndTurn`:
/// the turn ended, nobody interrupted it.
StationarityHalted {
tool_name: String,
run_len: u32,
true_noop: bool,
},
Rewound,
/// A queued prompt was removed (or cleared) from the server-authoritative
/// queue before it ever ran. Used to resolve the still-pending
crates/codegen/kigi-shell/src/session/compaction.rs
+1
View File
@@ -2154,6 +2154,7 @@ mod inline_auto_compact_flow_tests {
);
chat_state_handle.record_token_usage(total_tokens);
SessionActor {
swarm_mode: std::cell::Cell::new(Default::default()),
session_info: SessionInfo {
id: acp::SessionId::new("test-auto-compact"),
cwd: cwd.as_str().to_string(),
crates/codegen/kigi-shell/src/session/mod.rs
+2
View File
@@ -326,9 +326,11 @@ pub mod restore;
pub mod result;
pub mod signals;
pub(crate) mod slash_commands;
pub(crate) mod stationarity;
pub mod storage;
pub(crate) mod streaming_capture;
pub(crate) mod summary;
pub mod swarm_mode;
pub(crate) mod telemetry;
pub mod tool_index;
pub(crate) mod turn_completion;
crates/codegen/kigi-shell/src/session/slash_commands.rs
+90
View File
@@ -45,6 +45,10 @@ pub(crate) enum BuiltinGate {
/// available (graph nodes execute as goals, so `/graph` needs
/// everything `/goal` needs).
Graph,
/// The `agent_swarm` tool is in the session toolset. The mode is only a
/// standing instruction to use that tool, so without it the command would
/// advertise a doctrine the model has no way to follow.
Swarm,
}
/// All built-in slash commands. Order here = display order in autocomplete.
@@ -303,6 +307,26 @@ pub(super) const BUILTIN_COMMANDS: &[BuiltinCommand] = &[
}
},
},
BuiltinCommand {
name: "swarm",
description: "Delegate aggressively: split the work across a fleet of subagents",
argument_hint: Some("[on | off | <task>]"),
aliases: &[],
gate: BuiltinGate::Swarm,
resolve: |args| {
let trimmed = args.trim();
match trimmed.to_lowercase().as_str() {
"on" => BuiltinAction::SwarmSet { enabled: true },
"off" => BuiltinAction::SwarmSet { enabled: false },
"" => BuiltinAction::SwarmToggle,
// Anything else is the task itself: arm the mode for exactly
// this turn and send the text as the prompt.
_ => BuiltinAction::SwarmTask {
prompt: trimmed.to_string(),
},
}
},
},
];
/// Split a trailing `--budget <tokens>` flag off a `/goal` objective.
@@ -437,6 +461,8 @@ pub(crate) struct CommandAvailability {
/// `/graph` gate: the graph feature flag AND the goal harness (nodes
/// execute as goals) are both available.
pub graph: bool,
/// `/swarm` gate: the `agent_swarm` tool is in the active toolset.
pub swarm: bool,
}
impl CommandAvailability {
@@ -452,6 +478,7 @@ impl CommandAvailability {
BuiltinGate::Plugins => self.plugins,
BuiltinGate::Goal => self.goal,
BuiltinGate::Graph => self.graph,
BuiltinGate::Swarm => self.swarm,
}
}
@@ -468,6 +495,7 @@ impl CommandAvailability {
plugins: true,
goal: true,
graph: true,
swarm: true,
}
}
}
@@ -705,6 +733,17 @@ pub(super) enum BuiltinAction {
token_budget: Option<i64>,
},
GoalStatus,
/// `/swarm on|off` — arm or disarm the standing delegate-aggressively
/// instruction. Survives turns until switched off.
SwarmSet {
enabled: bool,
},
/// `/swarm` with no argument.
SwarmToggle,
/// `/swarm <task>` — arm for this turn only, then send `prompt`.
SwarmTask {
prompt: String,
},
GoalPause,
GoalResume,
GoalClear,
@@ -757,6 +796,9 @@ impl BuiltinAction {
| BuiltinAction::GraphPause
| BuiltinAction::GraphResume { .. }
| BuiltinAction::GraphClear => "graph",
BuiltinAction::SwarmSet { .. }
| BuiltinAction::SwarmToggle
| BuiltinAction::SwarmTask { .. } => "swarm",
}
}
@@ -795,6 +837,8 @@ impl BuiltinAction {
| BuiltinAction::GraphShow
| BuiltinAction::GraphPause
| BuiltinAction::GraphClear => false,
BuiltinAction::SwarmToggle => false,
BuiltinAction::SwarmSet { .. } | BuiltinAction::SwarmTask { .. } => true,
}
}
}
@@ -1584,6 +1628,7 @@ mod tests {
"feedback",
"goal",
"graph",
"swarm",
"loop",
"commit",
"deploy",
@@ -1694,6 +1739,51 @@ mod tests {
);
}
/// Without the `agent_swarm` tool the mode has nothing to steer toward, so
/// the command must fall through as ordinary prompt text rather than
/// arming a doctrine the model cannot act on.
#[test]
fn swarm_does_not_resolve_when_gate_off() {
let availability = CommandAvailability {
swarm: false,
..CommandAvailability::all_enabled()
};
assert!(
resolve(
vec![text_block("/swarm on")],
&[],
availability,
SkillSlashRewrite::default(),
)
.is_ok(),
"expected pass-through (Ok), got an outcome",
);
}
#[test]
fn swarm_resolves_each_form_to_its_own_action() {
assert!(matches!(
resolve_builtin("swarm", "on").expect("/swarm on must resolve"),
BuiltinAction::SwarmSet { enabled: true }
));
assert!(matches!(
resolve_builtin("swarm", "off").expect("/swarm off must resolve"),
BuiltinAction::SwarmSet { enabled: false }
));
assert!(matches!(
resolve_builtin("swarm", "").expect("bare /swarm must resolve"),
BuiltinAction::SwarmToggle
));
// Anything else is the task, NOT an unknown subcommand: mis-parsing it
// would silently drop the user's work instead of running it.
match resolve_builtin("swarm", "split the auth refactor")
.expect("/swarm <task> must resolve")
{
BuiltinAction::SwarmTask { prompt } => assert_eq!(prompt, "split the auth refactor"),
other => panic!("expected SwarmTask, got {}", other.command_name()),
}
}
#[test]
fn graph_resolves_subcommands_and_budget() {
let set = resolve_builtin("graph", "ship the feature --budget 5000")
crates/codegen/kigi-shell/src/session/stationarity.rs
+216
View File
@@ -0,0 +1,216 @@
//! Detects a model stuck repeating one identical tool call.
/// Consecutive identical batches after which the turn is halted.
pub(crate) const MAX_CONSECUTIVE_IDENTICAL_TOOL_CALLS: u32 = 16;
/// Nudge threshold; half the budget remains after it.
pub(crate) const NUDGE_AFTER_IDENTICAL_TOOL_CALLS: u32 = 8;
/// Below the nudge on purpose: no-op runs get none.
pub(crate) const MAX_CONSECUTIVE_TRUE_NOOPS: u32 = 4;
const _: () = assert!(NUDGE_AFTER_IDENTICAL_TOOL_CALLS < MAX_CONSECUTIVE_IDENTICAL_TOOL_CALLS);
const _: () = assert!(MAX_CONSECUTIVE_TRUE_NOOPS < NUDGE_AFTER_IDENTICAL_TOOL_CALLS);
/// A shell command that does nothing whatsoever.
pub(crate) fn command_is_true(cmd: &str) -> bool {
cmd.trim().eq_ignore_ascii_case("true")
}
/// Hashes name+args per call; separators prevent concatenation collisions.
pub(crate) fn hash_batch<'a>(calls: impl IntoIterator<Item = (&'a str, &'a str)>) -> u64 {
use std::hash::{Hash, Hasher};
let mut hasher = std::collections::hash_map::DefaultHasher::new();
for (name, args) in calls {
name.hash(&mut hasher);
'\u{1f}'.hash(&mut hasher);
args.hash(&mut hasher);
'\u{1e}'.hash(&mut hasher);
}
hasher.finish()
}
/// One identity, so re-spelling a no-op cannot reset it.
const TRUE_NOOP_HASH: u64 = u64::MAX;
/// How many times the current batch has repeated unchanged.
#[derive(Default)]
pub(crate) struct IdenticalToolCallRun {
/// Hash only: signatures hold raw tool arguments.
last_hash: Option<u64>,
tool_name: String,
run_len: u32,
is_true_noop_run: bool,
}
impl IdenticalToolCallRun {
/// Records one batch and returns the length of the run it belongs to.
pub(crate) fn observe(&mut self, batch_hash: u64, tool_name: &str, is_true_noop: bool) -> u32 {
let hash = if is_true_noop {
TRUE_NOOP_HASH
} else {
batch_hash
};
if self.last_hash == Some(hash) {
self.run_len += 1;
} else {
self.run_len = 1;
self.last_hash = Some(hash);
self.is_true_noop_run = is_true_noop;
}
self.tool_name = tool_name.to_string();
self.run_len
}
/// The run length at which this turn must be halted.
pub(crate) fn hard_stop_threshold(&self) -> u32 {
if self.is_true_noop_run {
MAX_CONSECUTIVE_TRUE_NOOPS
} else {
MAX_CONSECUTIVE_IDENTICAL_TOOL_CALLS
}
}
pub(crate) fn tool_name(&self) -> &str {
&self.tool_name
}
pub(crate) fn is_true_noop_run(&self) -> bool {
self.is_true_noop_run
}
}
#[cfg(test)]
mod tests {
use super::*;
fn call(name: &str, args: &str) -> u64 {
hash_batch([(name, args)])
}
#[test]
fn an_unchanged_batch_accumulates_a_run() {
let mut run = IdenticalToolCallRun::default();
let h = call("read_file", "a.rs");
assert_eq!(run.observe(h, "read_file", false), 1);
assert_eq!(run.observe(h, "read_file", false), 2);
assert_eq!(run.observe(h, "read_file", false), 3);
}
#[test]
fn any_change_in_the_arguments_restarts_the_run() {
let mut run = IdenticalToolCallRun::default();
run.observe(call("read_file", "a.rs"), "read_file", false);
run.observe(call("read_file", "a.rs"), "read_file", false);
assert_eq!(
run.observe(call("read_file", "b.rs"), "read_file", false),
1,
"a different argument is a different action"
);
}
#[test]
fn two_batches_cannot_collide_by_concatenation() {
// Unseparated these would hash identically.
assert_ne!(
hash_batch([("ab", "cd")]),
hash_batch([("a", "b"), ("c", "d")])
);
}
#[test]
fn no_ops_share_one_run_however_they_are_spelled() {
let mut run = IdenticalToolCallRun::default();
assert_eq!(run.observe(call("bash", "true"), "bash", true), 1);
assert_eq!(
run.observe(call("bash", " TRUE "), "bash", true),
2,
"re-spelling a no-op must not reset the tighter ceiling"
);
assert_eq!(run.hard_stop_threshold(), MAX_CONSECUTIVE_TRUE_NOOPS);
}
#[test]
fn a_real_call_after_a_noop_run_restores_the_ordinary_ceiling() {
let mut run = IdenticalToolCallRun::default();
run.observe(call("bash", "true"), "bash", true);
assert_eq!(run.hard_stop_threshold(), MAX_CONSECUTIVE_TRUE_NOOPS);
run.observe(call("read_file", "a.rs"), "read_file", false);
assert_eq!(
run.hard_stop_threshold(),
MAX_CONSECUTIVE_IDENTICAL_TOOL_CALLS
);
}
#[test]
fn an_ordinary_repeated_call_is_halted_at_its_ceiling_and_not_before() {
let mut run = IdenticalToolCallRun::default();
let h = call("read_file", "a.rs");
for expected in 1..MAX_CONSECUTIVE_IDENTICAL_TOOL_CALLS {
let len = run.observe(h, "read_file", false);
assert_eq!(len, expected);
assert!(len < run.hard_stop_threshold(), "must not halt early");
}
assert_eq!(
run.observe(h, "read_file", false),
run.hard_stop_threshold(),
"the turn halts on the 16th identical call"
);
}
#[test]
fn a_repeated_no_op_is_halted_far_sooner_and_without_a_nudge() {
let mut run = IdenticalToolCallRun::default();
let h = call("bash", "true");
let mut len = 0;
while len < run.hard_stop_threshold() {
len = run.observe(h, "bash", true);
}
assert_eq!(len, MAX_CONSECUTIVE_TRUE_NOOPS);
assert!(
len < NUDGE_AFTER_IDENTICAL_TOOL_CALLS,
"documented: a no-op run is halted before any nudge could fire"
);
}
#[test]
fn the_nudge_lands_with_budget_left_to_act_on_it() {
let mut run = IdenticalToolCallRun::default();
let h = call("read_file", "a.rs");
let mut len = 0;
while len < NUDGE_AFTER_IDENTICAL_TOOL_CALLS {
len = run.observe(h, "read_file", false);
}
assert!(
len < run.hard_stop_threshold(),
"a warning the model cannot act on is not a warning"
);
}
#[test]
fn work_interleaved_with_repeats_is_never_halted() {
let mut run = IdenticalToolCallRun::default();
for i in 0..MAX_CONSECUTIVE_IDENTICAL_TOOL_CALLS * 2 {
let h = if i % 2 == 0 {
call("read_file", "a.rs")
} else {
call("read_file", "b.rs")
};
let len = run.observe(h, "read_file", false);
assert!(
len < run.hard_stop_threshold(),
"alternating calls are progress, not a loop"
);
}
}
#[test]
fn only_a_bare_true_counts_as_a_no_op() {
assert!(command_is_true("true"));
assert!(command_is_true(" true "));
assert!(command_is_true("TRUE"));
assert!(!command_is_true("true && make"));
assert!(!command_is_true("truely"));
assert!(!command_is_true(""));
}
}
crates/codegen/kigi-shell/src/session/swarm_mode.rs
+178
View File
@@ -0,0 +1,178 @@
//! Swarm mode: a standing instruction to split work across a fleet.
//!
//! The `agent_swarm` tool works with the mode off; what the mode adds is the
//! doctrine — decompose finely, give every member a disjoint scope, do not do
//! the work yourself. Kept as pure state so the turn loop decides when to
//! inject and the session decides when to persist.
use serde::{Deserialize, Serialize};
/// Why the mode is on, which is what decides when it turns off.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SwarmTrigger {
/// `/swarm on` (or a bare `/swarm` toggle): stays until switched off.
Manual,
/// `/swarm <task>`: armed for exactly that turn.
Task,
}
/// The session's swarm-mode state. `None` means off.
///
/// Deliberately NOT persisted, unlike `/goal` and `/graph`: those drive
/// autonomous multi-turn work that is stranded if it is lost, whereas this is
/// a prompt hint whose worst-case recovery is typing `/swarm on` again. The
/// injected doctrine IS durable (it rides the conversation), so a resumed
/// session can read as "off" with the instruction still in context — which is
/// exactly why an explicit `/swarm off` always retracts (see
/// [`SessionActor::apply_swarm_mode`]) rather than trusting a remembered flag
/// that a restore, a compaction or a fork can each falsify.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
pub struct SwarmMode {
trigger: Option<SwarmTrigger>,
}
impl SwarmMode {
pub fn is_active(self) -> bool {
self.trigger.is_some()
}
pub fn trigger(self) -> Option<SwarmTrigger> {
self.trigger
}
/// Arms the mode, and does NOTHING if it is already armed.
///
/// Total no-op, not just "don't re-inject": overwriting the trigger would
/// let the `/swarm <task>` shorthand downgrade a standing `/swarm on` into
/// a per-turn mode, which then disarms itself at that turn's end — the
/// user's deliberate choice, silently undone.
///
/// Returns whether the caller should inject the enter reminder.
pub fn enter(&mut self, trigger: SwarmTrigger) -> bool {
if self.trigger.is_some() {
return false;
}
self.trigger = Some(trigger);
true
}
/// Disarms. Returns whether the mode had been armed — which is what an
/// AUTOMATIC expiry keys its retraction off. An explicit `/swarm off` must
/// retract regardless (see the type docs).
pub fn exit(&mut self) -> bool {
self.trigger.take().is_some()
}
/// Whether a turn ending now should disarm the mode.
///
/// Only the `Task` trigger auto-exits: `/swarm on` is a standing choice the
/// user made and a turn boundary is not a reason to undo it.
pub fn expires_at_turn_end(self) -> bool {
self.trigger == Some(SwarmTrigger::Task)
}
}
/// The doctrine injected when the mode is armed.
///
/// Deliberately short: it is re-read on every turn it is live, and the tool's
/// own description already carries the mechanics.
pub const SWARM_ENTER_REMINDER: &str = "\
Swarm mode is on. Explore only as far as you must to identify the work, then \
split it: use the agent_swarm tool with one item per independent scope rather \
than doing the work yourself. Decompose finely — do not try to conserve \
members. Every member must own a disjoint scope; members share one working \
tree, so two members told to touch the same file will corrupt each other. \
Read-only scopes may overlap. If the work genuinely does not split, say so and \
carry on alone.";
/// Injected when the mode is switched off mid-conversation, so the earlier
/// doctrine does not keep steering the model.
/// Deliberately as emphatic as the enter doctrine it revokes: a one-line
/// "mode is off" is the weaker of the two texts in context and the likelier to
/// be summarised away, leaving the fan-out directives still steering.
pub const SWARM_EXIT_REMINDER: &str = "\
Swarm mode is off. The swarm instructions above no longer apply — you are not \
required to split work across subagents, and you should not decompose a task \
just because they said to. Decide how to approach each new request from the \
request itself. Delegate only where it clearly helps.";
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn a_fresh_session_has_the_mode_off() {
let mode = SwarmMode::default();
assert!(!mode.is_active());
assert!(!mode.expires_at_turn_end());
}
#[test]
fn arming_asks_for_the_doctrine_once_not_once_per_command() {
let mut mode = SwarmMode::default();
assert!(mode.enter(SwarmTrigger::Manual), "first arm injects");
assert!(
!mode.enter(SwarmTrigger::Manual),
"a repeated /swarm on must not stack a second copy"
);
assert!(mode.is_active());
}
#[test]
fn only_the_task_trigger_expires_at_a_turn_boundary() {
let mut manual = SwarmMode::default();
manual.enter(SwarmTrigger::Manual);
assert!(
!manual.expires_at_turn_end(),
"/swarm on is a standing choice, not a per-turn one"
);
let mut task = SwarmMode::default();
task.enter(SwarmTrigger::Task);
assert!(task.expires_at_turn_end());
}
#[test]
fn exiting_retracts_exactly_once() {
let mut mode = SwarmMode::default();
mode.enter(SwarmTrigger::Manual);
assert!(mode.exit(), "the live doctrine must be retracted");
assert!(!mode.is_active());
assert!(
!mode.exit(),
"a second /swarm off has nothing left to retract"
);
}
/// `/swarm <task>` under a standing `/swarm on` must seed the turn and
/// nothing more — it must not convert the standing mode into a per-turn
/// one that disarms itself when that turn ends.
#[test]
fn the_task_shorthand_never_downgrades_a_standing_mode() {
let mut mode = SwarmMode::default();
mode.enter(SwarmTrigger::Manual);
assert!(
!mode.enter(SwarmTrigger::Task),
"the doctrine is already in the conversation"
);
assert_eq!(mode.trigger(), Some(SwarmTrigger::Manual));
assert!(
!mode.expires_at_turn_end(),
"the user's standing /swarm on must survive the turn"
);
}
/// An automatic expiry has nothing to retract once the mode is already
/// off; only an explicit `/swarm off` retracts unconditionally, and that
/// rule lives at the call site, not here.
#[test]
fn exit_reports_whether_it_actually_disarmed_something() {
let mut armed = SwarmMode::default();
armed.enter(SwarmTrigger::Task);
assert!(armed.exit());
let mut idle = SwarmMode::default();
assert!(!idle.exit());
}
}
crates/codegen/kigi-shell/src/tools/config.rs
+13
View File
@@ -108,6 +108,10 @@ pub struct WebFetchToolConfig {
/// default allowlist. An explicit empty list blocks all fetches.
/// Resolution: TOML > remote settings > built-in defaults.
pub allowed_domains: Option<Vec<String>>,
/// Allow fetches to explicit loopback hosts only (`localhost` /
/// `127.0.0.0/8` / `::1`). Private and metadata ranges stay blocked.
/// Resolution: TOML > `KIGI_WEB_FETCH_ALLOW_LOCAL` env > false.
pub allow_local: Option<bool>,
}
impl WebFetchToolConfig {
@@ -137,10 +141,15 @@ impl WebFetchToolConfig {
.cloned()
.or_else(|| remote_domains.map(|d| d.to_vec()));
let allow_local = self
.allow_local
.or_else(|| kigi_config::env_bool("KIGI_WEB_FETCH_ALLOW_LOCAL"));
kigi_tools::implementations::kigi::web_fetch::WebFetchParams {
proxy_endpoint,
allowed_domains,
context_window_tokens,
allow_local,
..Default::default()
}
}
@@ -484,6 +493,7 @@ mod tests {
let local = WebFetchToolConfig {
proxy_endpoint: Some("https://toml-proxy.example.com".to_owned()),
allowed_domains: Some(vec!["toml.example.com".to_owned()]),
allow_local: Some(true),
};
let params = local.resolve_params(
Some("https://remote-proxy.example.com"),
@@ -498,6 +508,7 @@ mod tests {
params.allowed_domains,
Some(vec!["toml.example.com".to_owned()])
);
assert!(params.allow_local(), "the opt-in must reach the tool");
}
#[test]
@@ -524,6 +535,7 @@ mod tests {
let params = local.resolve_params(None, None, None);
assert!(params.proxy_endpoint.is_none());
assert!(params.allowed_domains.is_none());
assert!(!params.allow_local(), "local access is off by default");
}
#[test]
@@ -531,6 +543,7 @@ mod tests {
let local = WebFetchToolConfig {
proxy_endpoint: None,
allowed_domains: Some(vec![]),
allow_local: None,
};
let params = local.resolve_params(None, Some(&["remote.example.com".to_owned()]), None);
assert_eq!(params.allowed_domains, Some(vec![]));
crates/codegen/kigi-tools/src/implementations/kigi/agent_swarm/mod.rs
+1 -1
View File
@@ -4,4 +4,4 @@ pub mod run;
pub mod schedule;
pub mod tool;
pub use tool::AgentSwarmTool;
pub use tool::{AGENT_SWARM_TOOL_NAME, AgentSwarmTool};
crates/codegen/kigi-tools/src/implementations/kigi/agent_swarm/run.rs
+39 -1
View File
@@ -341,7 +341,10 @@ fn build_request(pending: &Pending, config: &SwarmRunConfig) -> SubagentRequest
SubagentRequest {
id: uuid::Uuid::now_v7().to_string(),
prompt: pending.spec.prompt.clone(),
description: config.description.clone(),
// The ITEM, not the swarm's description: every member would otherwise
// render as an identical subagent block and the user could not tell
// which one is running, or which one failed.
description: pending.spec.item.clone(),
subagent_type: config.subagent_type.clone(),
parent_session_id: config.parent_session_id.clone(),
parent_prompt_id: config.parent_prompt_id.clone(),
@@ -690,6 +693,41 @@ mod tests {
);
}
/// Each member must be identifiable while it runs: the TUI renders one
/// subagent block per member from this description, so a shared one leaves
/// the user staring at N identical rows.
#[tokio::test(start_paused = true)]
async fn each_member_is_labelled_with_its_own_item() {
let backend = Arc::new(FakeBackend::default());
let seen = Arc::new(Mutex::new(Vec::new()));
let recorder = seen.clone();
let specs = specs(&["a.rs", "b.rs"]);
let config = SwarmRunConfig {
description: "review files".into(),
..config(None)
};
// `build_request` is the only place the label is set, so assert on it
// directly rather than through the backend's prompt log.
for (index, spec) in specs.iter().enumerate() {
let pending = Pending {
index,
spec: spec.clone(),
attempts: 0,
not_before: None,
};
recorder
.lock()
.unwrap()
.push(build_request(&pending, &config).description);
}
assert_eq!(
*seen.lock().unwrap(),
vec!["a.rs".to_string(), "b.rs".to_string()],
"each member must carry its own item, not the swarm description"
);
drop(backend);
}
/// Dropping the runner is what a send-now interrupt does; the members must
/// be cancelled rather than silently detached onto the user's tree.
#[tokio::test(start_paused = true)]
crates/codegen/kigi-tools/src/implementations/kigi/agent_swarm/tool.rs
+6 -2
View File
@@ -31,6 +31,10 @@ For a single item, use the subagent (task) tool instead. To continue members fro
swarm, pass `resume_agent_ids` mapping the agent_id values from that swarm's result to a \
follow-up prompt.";
/// Registry name, so gating code matches on one definition rather than a
/// literal that can drift from the tool id.
pub const AGENT_SWARM_TOOL_NAME: &str = "agent_swarm";
#[derive(Debug, Default)]
pub struct AgentSwarmTool;
@@ -66,14 +70,14 @@ impl kigi_tool_runtime::Tool for AgentSwarmTool {
type Output = ToolOutput;
fn id(&self) -> kigi_tool_protocol::ToolId {
kigi_tool_protocol::ToolId::new("agent_swarm").expect("valid tool id")
kigi_tool_protocol::ToolId::new(AGENT_SWARM_TOOL_NAME).expect("valid tool id")
}
fn description(
&self,
_ctx: &::kigi_tool_runtime::ListToolsContext,
) -> kigi_tool_types::ToolDescription {
kigi_tool_types::ToolDescription::new("agent_swarm", DESCRIPTION)
kigi_tool_types::ToolDescription::new(AGENT_SWARM_TOOL_NAME, DESCRIPTION)
}
fn capabilities(&self) -> kigi_tool_protocol::ToolCapabilities {
crates/codegen/kigi-tools/src/implementations/kigi/mod.rs
+1 -1
View File
@@ -22,7 +22,7 @@ pub mod todo;
pub mod update_goal;
pub mod web_fetch;
pub mod web_search;
pub use agent_swarm::AgentSwarmTool;
pub use agent_swarm::{AGENT_SWARM_TOOL_NAME, AgentSwarmTool};
pub use ask_user_question::AskUserQuestionTool;
pub use bash::BashTool;
pub use deploy_app::{AppBuilderDeployerConfig, DEPLOY_APP_TOOL_NAME};
crates/codegen/kigi-tools/src/implementations/kigi/web_fetch/client.rs
+140 -16
View File
@@ -155,6 +155,9 @@ impl WebFetchClient {
}
}
// Before any egress: the service must not see this.
ssrf::check_ssrf(&url, self.params.allow_local()).await?;
// Kimi fetch service first (OAuth sessions); local pipeline is the
// fallback on any service failure (kimi-cli fetch.py `__call__`).
if let Some(service_url) = self.params.service_url.clone() {
@@ -182,10 +185,15 @@ impl WebFetchClient {
}
}
ssrf::check_ssrf(&url).await?;
let http = self.http.get_or_rebuild()?;
let result = match fetch_url(&http, &url, self.params.max_content_length()).await {
let result = match fetch_url(
&http,
&url,
self.params.max_content_length(),
self.params.allow_local(),
)
.await
{
Ok(result) => result,
Err(e @ WebFetchError::HttpRequest(_)) => {
self.http.invalidate();
@@ -380,6 +388,8 @@ fn validate_url(raw: &str) -> Result<Url, WebFetchError> {
if let Some(host) = parsed.host_str()
&& host.split('.').count() < 2
// `localhost` is single-label; SSRF still gates it on allow_local.
&& !ssrf::is_explicit_local_host(host)
{
return Err(WebFetchError::SingleLabelHost {
host: host.to_string(),
@@ -390,9 +400,16 @@ fn validate_url(raw: &str) -> Result<Url, WebFetchError> {
}
fn upgrade_to_https(url: &mut Url) {
if url.scheme() == "http" {
let _ = url.set_scheme("https");
if url.scheme() != "http" {
return;
}
// Local dev servers rarely serve TLS; SSRF still gates them.
if let Some(host) = url.host_str()
&& ssrf::is_explicit_local_host(host)
{
return;
}
let _ = url.set_scheme("https");
}
enum FetchResult {
@@ -409,15 +426,21 @@ enum FetchResult {
}
/// Fetch a URL with manual same-host redirect handling.
///
/// Every hop is re-checked, so a rebinding name cannot pass.
/// Partial: reqwest hides the peer IP of the live connection.
async fn fetch_url(
client: &reqwest::Client,
url: &Url,
max_content_length: usize,
allow_local: bool,
) -> Result<FetchResult, WebFetchError> {
let mut current_url = url.clone();
let mut hops = 0;
loop {
ssrf::check_ssrf(&current_url, allow_local).await?;
let resp = client
.get(current_url.as_str())
.header(USER_AGENT, USER_AGENT_STRING)
@@ -439,10 +462,13 @@ async fn fetch_url(
if let Some(location) = resp.headers().get("location") {
let location_str = location.to_str().unwrap_or("");
let next_url = current_url
let mut next_url = current_url
.join(location_str)
.map_err(|e| WebFetchError::InvalidRedirect(format!("{e}")))?;
if is_same_host(&current_url, &next_url) {
// An absolute `http://` Location would downgrade the hop.
upgrade_to_https(&mut next_url);
// check_ssrf runs at the top of the next iteration.
current_url = next_url;
continue;
}
@@ -479,13 +505,11 @@ async fn fetch_url(
}
}
/// Exact host equality, no `www.` stripping.
///
/// A `www` sibling has separate records, so it is cross-host.
fn is_same_host(a: &Url, b: &Url) -> bool {
fn strip_www(h: &str) -> &str {
h.strip_prefix("www.").unwrap_or(h)
}
let host_a = a.host_str().unwrap_or("");
let host_b = b.host_str().unwrap_or("");
strip_www(host_a) == strip_www(host_b)
a.host_str() == b.host_str()
}
fn require_media_session_folder(session_folder: Option<&Path>) -> Result<&Path, WebFetchError> {
@@ -963,6 +987,78 @@ mod tests {
assert!(matches!(err, WebFetchError::ServiceUnavailable(_)), "{err}");
}
/// A blocked target must never reach the remote fetch service.
///
/// It egresses elsewhere, so posting leaks an internal URL.
#[tokio::test]
async fn a_blocked_url_never_reaches_the_fetch_service() {
use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};
let server = MockServer::start().await;
Mock::given(method("POST"))
.and(path("/fetch"))
.respond_with(ResponseTemplate::new(200).set_body_string("{}"))
.mount(&server)
.await;
let provider = crate::types::api_key_provider::test_support::fixed_provider("t");
let params = WebFetchParams {
service_url: Some(format!("{}/fetch", server.uri())),
..WebFetchParams::default()
};
let client = WebFetchClient::new(&params, Some(provider)).unwrap();
let Err(err) = client
.fetch(
"http://localhost:8080/admin?token=secret",
"c",
None,
None,
None,
)
.await
else {
panic!("a loopback target must be blocked");
};
assert!(matches!(err, WebFetchError::SsrfBlocked { .. }), "{err}");
assert!(
server.received_requests().await.unwrap().is_empty(),
"the internal URL must never be posted anywhere"
);
}
/// `fetch_url` gates its own target, not trusting its caller.
///
/// Only hop one is covered: same-host hops share one verdict,
/// so rebinding between them needs a live resolver to observe.
#[tokio::test]
async fn fetch_url_blocks_a_loopback_target_without_allow_local() {
use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};
let server = MockServer::start().await;
Mock::given(method("GET"))
.and(path("/x"))
.respond_with(ResponseTemplate::new(200).set_body_string("<p>local</p>"))
.mount(&server)
.await;
let url = Url::parse(&format!("{}/x", server.uri())).unwrap();
let http = HttpClient::new(&WebFetchParams::default())
.unwrap()
.get_or_rebuild()
.unwrap();
let Err(err) = fetch_url(&http, &url, 1_000_000, false).await else {
panic!("a blocked host must not be fetched");
};
assert!(matches!(err, WebFetchError::SsrfBlocked { .. }), "{err}");
assert!(
server.received_requests().await.unwrap().is_empty(),
"a blocked host must not be contacted at all"
);
let ok = fetch_url(&http, &url, 1_000_000, true).await.unwrap();
assert!(matches!(ok, FetchResult::Content { .. }));
}
fn test_converter() -> htmd::HtmlToMarkdown {
htmd::HtmlToMarkdown::builder()
.skip_tags(vec![
@@ -1024,9 +1120,12 @@ mod tests {
#[test]
fn validate_url_rejects_single_label_hosts() {
assert!(validate_url("http://localhost:8080/foo").is_err());
assert!(validate_url("http://intranet/foo").is_err());
assert!(validate_url("http://metadata/computeMetadata").is_err());
assert!(
validate_url("http://localhost:8080/foo").is_ok(),
"localhost reaches the SSRF gate, which blocks it unless opted in"
);
}
#[test]
@@ -1068,6 +1167,19 @@ mod tests {
assert_eq!(url.scheme(), "https");
}
/// Upgrading a local host breaks the only target `allow_local` opens.
#[test]
fn upgrade_to_https_skips_explicit_local_hosts() {
for raw in ["http://127.0.0.1:8080/", "http://localhost:3000/"] {
let mut url = Url::parse(raw).unwrap();
upgrade_to_https(&mut url);
assert_eq!(url.scheme(), "http", "{raw}");
}
let mut public = Url::parse("http://example.com/").unwrap();
upgrade_to_https(&mut public);
assert_eq!(public.scheme(), "https");
}
#[test]
fn same_host_exact_match() {
let a = Url::parse("https://example.com/a").unwrap();
@@ -1075,12 +1187,24 @@ mod tests {
assert!(is_same_host(&a, &b));
}
/// An absolute `http://` Location must not downgrade a followed hop.
#[test]
fn same_host_www_stripping() {
fn same_host_redirect_location_reupgrades_http() {
let origin = Url::parse("https://example.com/start").unwrap();
let mut next = origin.join("http://example.com/next").unwrap();
assert_eq!(next.scheme(), "http");
assert!(is_same_host(&origin, &next));
upgrade_to_https(&mut next);
assert_eq!(next.as_str(), "https://example.com/next");
}
/// A `www` sibling is a separate name, with separate records.
#[test]
fn www_subdomain_is_cross_host() {
let a = Url::parse("https://example.com/a").unwrap();
let c = Url::parse("https://www.example.com/a").unwrap();
assert!(is_same_host(&a, &c));
assert!(is_same_host(&c, &a));
assert!(!is_same_host(&a, &c));
assert!(!is_same_host(&c, &a));
}
#[test]
crates/codegen/kigi-tools/src/implementations/kigi/web_fetch/config.rs
+8
View File
@@ -47,12 +47,20 @@ pub struct WebFetchParams {
/// on any failure (kimi-cli `tools/web/fetch.py FetchURL.__call__`).
#[serde(default)]
pub service_url: Option<String>,
/// Opt-in for loopback targets; off means no local access.
#[serde(default)]
pub allow_local: Option<bool>,
}
register_resource!("kigi", "WebFetch", WebFetchParams);
// Keep defaults here so call-sites don't have to manage unwrapping.
impl WebFetchParams {
/// From config or `KIGI_WEB_FETCH_ALLOW_LOCAL`, never tool input.
pub fn allow_local(&self) -> bool {
self.allow_local.unwrap_or(false)
}
pub fn cache_ttl_secs(&self) -> Duration {
Duration::from_secs(self.cache_ttl_secs.unwrap_or(15 * 60))
}
crates/codegen/kigi-tools/src/implementations/kigi/web_fetch/mod.rs
+1 -1
View File
@@ -14,7 +14,7 @@ pub mod domain;
pub mod error;
mod http;
pub(crate) mod overflow;
mod ssrf;
pub mod ssrf;
pub use client::WebFetchClient;
pub use config::WebFetchParams;
crates/codegen/kigi-tools/src/implementations/kigi/web_fetch/ssrf.rs
+276 -91
View File
@@ -1,85 +1,143 @@
//! SSRF (Server-Side Request Forgery) protection for `web_fetch`.
//! SSRF protection for `web_fetch`.
//!
//! Validates that resolved IP addresses are not in private, link-local, or
//! cloud metadata ranges before allowing outbound HTTP requests.
//! Non-public targets are blocked: loopback, RFC 1918, link-local,
//! CGNAT, TEST-NET, reserved, ULA. Loopback is opt-in via
//! `[toolset.web_fetch] allow_local` or `KIGI_WEB_FETCH_ALLOW_LOCAL`,
//! and even then only for a literal local host.
//!
//! Reference: [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/)
use std::net::IpAddr;
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
use url::Url;
use super::error::WebFetchError;
/// Returns `true` if an IP address is in a private, link-local, or cloud
/// metadata range that should be blocked to prevent SSRF attacks.
/// Hosts allowed to reach loopback when local access is on.
///
/// **Allowed:** loopback (`127.x` / `::1`) for local development.
/// **Blocked:** RFC 1918, link-local, CGNAT/cloud metadata, unspecified.
pub(crate) fn is_blocked_ip(ip: &IpAddr) -> bool {
/// Names that merely RESOLVE to loopback are excluded: DNS rebinding.
pub fn is_explicit_local_host(host: &str) -> bool {
let host = host.trim().trim_end_matches('.').to_ascii_lowercase();
let host = host
.strip_prefix('[')
.and_then(|h| h.strip_suffix(']'))
.unwrap_or(&host);
// Drop an IPv6 zone id such as `fe80::1%lo0`.
let host = host.split('%').next().unwrap_or(host);
if host == "localhost" {
return true;
}
host.parse::<IpAddr>().is_ok_and(|ip| ip.is_loopback())
}
/// Whether an IP is not globally routable.
pub fn is_non_public_ip(ip: &IpAddr) -> bool {
match ip {
IpAddr::V4(v4) => {
let octets = v4.octets();
// Loopback (127.0.0.0/8) — allowed for local dev servers.
if octets[0] == 127 {
return false;
IpAddr::V4(v4) => is_non_public_ipv4(*v4),
IpAddr::V6(v6) => is_non_public_ipv6(*v6),
}
// RFC 1918: 10.0.0.0/8 — private network.
if octets[0] == 10 {
}
fn is_non_public_ipv4(ip: Ipv4Addr) -> bool {
ip.is_loopback()
|| ip.is_private()
|| ip.is_link_local()
|| ip.is_unspecified()
|| ip.is_multicast()
|| ip.is_broadcast()
// "This network" (RFC 1122) 0.0.0.0/8
|| ipv4_in_cidr(ip, [0, 0, 0, 0], 8)
// CGNAT (RFC 6598) — some clouds serve metadata here
|| ipv4_in_cidr(ip, [100, 64, 0, 0], 10)
// IETF Protocol Assignments (RFC 6890)
|| ipv4_in_cidr(ip, [192, 0, 0, 0], 24)
// TEST-NET-1 (RFC 5737)
|| ipv4_in_cidr(ip, [192, 0, 2, 0], 24)
// Benchmarking (RFC 2544)
|| ipv4_in_cidr(ip, [198, 18, 0, 0], 15)
// TEST-NET-2 / TEST-NET-3
|| ipv4_in_cidr(ip, [198, 51, 100, 0], 24)
|| ipv4_in_cidr(ip, [203, 0, 113, 0], 24)
// Reserved (RFC 6890)
|| ipv4_in_cidr(ip, [240, 0, 0, 0], 4)
}
fn ipv4_in_cidr(ip: Ipv4Addr, base: [u8; 4], prefix: u8) -> bool {
debug_assert!(prefix <= 32, "IPv4 prefix out of range");
let ip = u32::from(ip);
let base = u32::from(Ipv4Addr::from(base));
let mask = if prefix == 0 {
0
} else {
u32::MAX << (32 - prefix)
};
(ip & mask) == (base & mask)
}
fn is_non_public_ipv6(ip: Ipv6Addr) -> bool {
// Identity wins: `::1` is not judged as `0.0.0.1`.
if ip.is_loopback() || ip.is_unspecified() || ip.is_multicast() {
return true;
}
// RFC 1918: 172.16.0.0/12 — private network.
if octets[0] == 172 && (16..=31).contains(&octets[1]) {
return true;
if let Some(v4) = embedded_ipv4(ip) {
return is_non_public_ipv4(v4);
}
// RFC 1918: 192.168.0.0/16 — private network.
if octets[0] == 192 && octets[1] == 168 {
return true;
let seg = ip.segments();
ip.is_unique_local()
|| ip.is_unicast_link_local()
// Deprecated site-local (RFC 3879) fec0::/10
|| (seg[0] & 0xffc0) == 0xfec0
// Documentation (RFC 3849) 2001:db8::/32
|| (seg[0] == 0x2001 && seg[1] == 0x0db8)
}
// RFC 3927: 169.254.0.0/16 — link-local.
// Includes AWS/GCP/Azure metadata endpoint 169.254.169.254.
if octets[0] == 169 && octets[1] == 254 {
return true;
/// IPv4 reachable through a known IPv6 wrapper, if any.
///
/// Covers mapped, compatible, well-known NAT64, and 6to4. Not complete:
/// network-specific NAT64 prefixes (RFC 6052) cannot be enumerated.
fn embedded_ipv4(ip: Ipv6Addr) -> Option<Ipv4Addr> {
let seg = ip.segments();
let embedded = |hi: u16, lo: u16| Ipv4Addr::from(u32::from(hi) << 16 | u32::from(lo));
if seg[0] == 0x0064 && seg[1] == 0xff9b && seg[2..6] == [0, 0, 0, 0] {
return Some(embedded(seg[6], seg[7]));
}
// RFC 6598: 100.64.0.0/10 — CGNAT / shared address space.
// Used by some cloud providers for internal metadata services.
if octets[0] == 100 && (64..=127).contains(&octets[1]) {
return true;
if seg[0] == 0x2002 {
return Some(embedded(seg[1], seg[2]));
}
if v4.is_unspecified() {
return true;
}
false
// Covers `::ffff:a.b.c.d` and the deprecated `::a.b.c.d`.
ip.to_ipv4()
}
/// Loopback including IPv4-mapped forms like `::ffff:127.0.0.1`.
///
/// `IpAddr::is_loopback` is false for mapped addresses, so the opt-in path
/// cannot use it directly.
fn is_loopback_addr(ip: &IpAddr) -> bool {
match ip {
IpAddr::V4(v4) => v4.is_loopback(),
IpAddr::V6(v6) => {
// ::1 — loopback, allowed for local dev.
if v6.is_loopback() {
return false;
}
if v6.is_unspecified() {
return true;
}
// IPv4-mapped IPv6 (::ffff:x.x.x.x) — delegate to v4 checks.
if let Some(v4) = v6.to_ipv4_mapped() {
return is_blocked_ip(&IpAddr::V4(v4));
}
let segments = v6.segments();
// RFC 4291: fe80::/10 — link-local unicast.
if segments[0] & 0xffc0 == 0xfe80 {
return true;
}
// RFC 4193: fc00::/7 — unique local address (ULA).
if segments[0] & 0xfe00 == 0xfc00 {
return true;
}
false
v6.is_loopback() || v6.to_ipv4_mapped().is_some_and(|v4| v4.is_loopback())
}
}
}
/// Resolve hostname via DNS and verify none of the resolved addresses are
/// in blocked private/link-local ranges.
pub(crate) async fn check_ssrf(url: &Url) -> Result<(), WebFetchError> {
/// Dual gate: loopback opens only for an explicit local host.
///
/// Private and link-local never open through this flag.
/// Shared with the hook runner: one policy, every outbound URL.
pub fn is_blocked_for_host(ip: &IpAddr, host: &str, allow_local: bool) -> bool {
if !is_non_public_ip(ip) {
return false;
}
!(allow_local && is_loopback_addr(ip) && is_explicit_local_host(host))
}
/// Verifies no resolved address is blocked by the SSRF policy.
///
/// `allow_local` is config-only so the model cannot flip it.
pub(crate) async fn check_ssrf(url: &Url, allow_local: bool) -> Result<(), WebFetchError> {
let host = url
.host_str()
.ok_or_else(|| WebFetchError::SingleLabelHost {
@@ -87,7 +145,7 @@ pub(crate) async fn check_ssrf(url: &Url) -> Result<(), WebFetchError> {
})?;
if let Ok(ip) = host.parse::<IpAddr>() {
if is_blocked_ip(&ip) {
if is_blocked_for_host(&ip, host, allow_local) {
return Err(WebFetchError::SsrfBlocked {
host: host.to_string(),
ip,
@@ -112,7 +170,7 @@ pub(crate) async fn check_ssrf(url: &Url) -> Result<(), WebFetchError> {
addrs
.iter()
.find(|addr| is_blocked_ip(&addr.ip()))
.find(|addr| is_blocked_for_host(&addr.ip(), host, allow_local))
.map_or(Ok(()), |addr| {
Err(WebFetchError::SsrfBlocked {
host: host.to_string(),
@@ -127,86 +185,201 @@ mod tests {
#[test]
fn blocks_rfc1918_10x() {
assert!(is_blocked_ip(&"10.0.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"10.255.255.255".parse().unwrap()));
assert!(is_non_public_ip(&"10.0.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"10.255.255.255".parse().unwrap()));
}
#[test]
fn blocks_rfc1918_172x() {
assert!(is_blocked_ip(&"172.16.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"172.31.255.255".parse().unwrap()));
assert!(!is_blocked_ip(&"172.15.0.1".parse().unwrap()));
assert!(!is_blocked_ip(&"172.32.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"172.16.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"172.31.255.255".parse().unwrap()));
assert!(!is_non_public_ip(&"172.15.0.1".parse().unwrap()));
assert!(!is_non_public_ip(&"172.32.0.1".parse().unwrap()));
}
#[test]
fn blocks_rfc1918_192168() {
assert!(is_blocked_ip(&"192.168.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"192.168.255.255".parse().unwrap()));
assert!(is_non_public_ip(&"192.168.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"192.168.255.255".parse().unwrap()));
}
#[test]
fn blocks_link_local() {
assert!(is_blocked_ip(&"169.254.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"169.254.169.254".parse().unwrap()));
assert!(is_non_public_ip(&"169.254.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"169.254.169.254".parse().unwrap()));
}
#[test]
fn blocks_cgnat_cloud_metadata() {
assert!(is_blocked_ip(&"100.64.0.1".parse().unwrap()));
assert!(is_blocked_ip(&"100.127.255.255".parse().unwrap()));
assert!(!is_blocked_ip(&"100.63.0.1".parse().unwrap()));
assert!(!is_blocked_ip(&"100.128.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"100.64.0.1".parse().unwrap()));
assert!(is_non_public_ip(&"100.127.255.255".parse().unwrap()));
assert!(!is_non_public_ip(&"100.63.0.1".parse().unwrap()));
assert!(!is_non_public_ip(&"100.128.0.1".parse().unwrap()));
}
#[test]
fn blocks_unspecified() {
assert!(is_blocked_ip(&"0.0.0.0".parse().unwrap()));
assert!(is_blocked_ip(&"::".parse().unwrap()));
assert!(is_non_public_ip(&"0.0.0.0".parse().unwrap()));
assert!(is_non_public_ip(&"::".parse().unwrap()));
}
#[test]
fn allows_loopback() {
assert!(!is_blocked_ip(&"127.0.0.1".parse().unwrap()));
assert!(!is_blocked_ip(&"127.0.0.2".parse().unwrap()));
assert!(!is_blocked_ip(&"::1".parse().unwrap()));
fn blocks_loopback_by_default() {
for ip in ["127.0.0.1", "127.0.0.2", "::1", "::ffff:127.0.0.1"] {
let ip: IpAddr = ip.parse().unwrap();
assert!(is_non_public_ip(&ip), "{ip} must not be public");
assert!(
is_blocked_for_host(&ip, "localhost", false),
"{ip} must be blocked without allow_local"
);
}
}
#[test]
fn allow_local_opens_loopback_only_for_an_explicit_local_host() {
for (ip, host) in [
("127.0.0.1", "localhost"),
("127.0.0.1", "127.0.0.1"),
("::1", "::1"),
("::ffff:127.0.0.1", "localhost"),
] {
let ip: IpAddr = ip.parse().unwrap();
assert!(!is_blocked_for_host(&ip, host, true), "{ip} via {host}");
}
assert!(
is_blocked_for_host(&"127.0.0.1".parse().unwrap(), "evil.example.com", true),
"a public name resolving to loopback is DNS rebinding"
);
}
#[test]
fn allow_local_never_opens_private_or_link_local() {
for ip in ["10.0.0.1", "169.254.169.254", "192.168.1.1"] {
let ip: IpAddr = ip.parse().unwrap();
assert!(
is_blocked_for_host(&ip, "localhost", true),
"{ip} must stay blocked even with allow_local"
);
}
}
#[test]
fn blocks_test_net_and_reserved_ranges() {
for ip in [
"0.0.0.1",
"192.0.0.1",
"192.0.2.1",
"198.18.0.1",
"198.19.255.255",
"198.51.100.1",
"203.0.113.1",
"240.0.0.1",
] {
assert!(is_non_public_ip(&ip.parse().unwrap()), "{ip}");
}
// Neighbours of every range above must stay reachable.
for ip in [
"1.0.0.1",
"192.0.1.1",
"192.0.3.1",
"198.17.255.255",
"198.20.0.1",
"198.51.101.1",
"203.0.114.1",
"223.255.255.255",
] {
assert!(!is_non_public_ip(&ip.parse().unwrap()), "{ip}");
}
}
/// A v6 record can smuggle v4 through four wrapper prefixes.
#[test]
fn blocks_ipv4_smuggled_through_ipv6_wrappers() {
for ip in [
"64:ff9b::a9fe:a9fe",
"64:ff9b::7f00:1",
"2002:7f00:1::",
"::7f00:1",
"::a00:1",
"fec0::1",
"2001:db8::1",
] {
assert!(is_non_public_ip(&ip.parse().unwrap()), "{ip}");
}
for ip in ["64:ff9b::808:808", "2002:808:808::", "2001:db9::1"] {
assert!(!is_non_public_ip(&ip.parse().unwrap()), "{ip}");
}
}
#[test]
fn explicit_local_host_tolerates_brackets_dots_and_zone_ids() {
for host in [
"localhost",
"LOCALHOST.",
"127.0.0.1",
"127.1.2.3",
"::1",
"[::1]",
"::1%lo0",
] {
assert!(is_explicit_local_host(host), "{host}");
}
for host in [
"example.com",
"notlocalhost",
"localhost.evil.com",
"10.0.0.1",
] {
assert!(!is_explicit_local_host(host), "{host}");
}
}
#[test]
fn allows_public_ips() {
assert!(!is_blocked_ip(&"1.1.1.1".parse().unwrap()));
assert!(!is_blocked_ip(&"8.8.8.8".parse().unwrap()));
assert!(!is_blocked_ip(&"142.250.80.46".parse().unwrap()));
for ip in [
"1.1.1.1",
"8.8.8.8",
"142.250.80.46",
// Global unicast v6: guards the new masks against over-matching.
"2606:4700::1111",
"2001:4860:4860::8888",
] {
assert!(!is_non_public_ip(&ip.parse().unwrap()), "{ip}");
}
}
#[test]
fn blocks_ipv6_link_local() {
assert!(is_blocked_ip(&"fe80::1".parse().unwrap()));
assert!(is_non_public_ip(&"fe80::1".parse().unwrap()));
}
#[test]
fn blocks_ipv6_unique_local() {
assert!(is_blocked_ip(&"fc00::1".parse().unwrap()));
assert!(is_blocked_ip(&"fd00::1".parse().unwrap()));
assert!(is_non_public_ip(&"fc00::1".parse().unwrap()));
assert!(is_non_public_ip(&"fd00::1".parse().unwrap()));
}
#[test]
fn blocks_ipv4_mapped_ipv6_private() {
assert!(is_blocked_ip(&"::ffff:10.0.0.1".parse::<IpAddr>().unwrap()));
assert!(is_blocked_ip(
assert!(is_non_public_ip(
&"::ffff:10.0.0.1".parse::<IpAddr>().unwrap()
));
assert!(is_non_public_ip(
&"::ffff:192.168.1.1".parse::<IpAddr>().unwrap()
));
}
#[test]
fn allows_ipv4_mapped_ipv6_public() {
assert!(!is_blocked_ip(&"::ffff:8.8.8.8".parse::<IpAddr>().unwrap()));
assert!(!is_non_public_ip(
&"::ffff:8.8.8.8".parse::<IpAddr>().unwrap()
));
}
#[tokio::test]
async fn ssrf_blocks_ip_literal_private() {
let url = Url::parse("https://10.0.0.1/secret").unwrap();
let result = check_ssrf(&url).await;
let result = check_ssrf(&url, false).await;
assert!(result.is_err());
assert!(result.unwrap_err().to_string().contains("private"));
}
@@ -214,7 +387,19 @@ mod tests {
#[tokio::test]
async fn ssrf_allows_ip_literal_public() {
let url = Url::parse("https://1.1.1.1/").unwrap();
let result = check_ssrf(&url).await;
let result = check_ssrf(&url, false).await;
assert!(result.is_ok());
}
#[tokio::test]
async fn ssrf_blocks_loopback_literal_by_default() {
let url = Url::parse("http://127.0.0.1:8080/").unwrap();
assert!(check_ssrf(&url, false).await.is_err());
}
#[tokio::test]
async fn ssrf_allows_loopback_literal_when_opted_in() {
let url = Url::parse("http://127.0.0.1:8080/").unwrap();
assert!(check_ssrf(&url, true).await.is_ok());
}
}
crates/codegen/kigi-tui/docs/user-guide/05-configuration.md
+8
View File
@@ -225,8 +225,16 @@ timeout_secs = 1800 # seconds to wait when enabled (default:
[toolset.web_fetch]
proxy_endpoint = "https://proxy.example.com" # egress proxy URL
allowed_domains = ["docs.rs", "x.ai"] # override the built-in allowlist
allow_local = false # true = reach localhost / 127.0.0.0/8 / ::1
```
`allow_local` opens **loopback only**, and only when the URL names it
explicitly (`http://127.0.0.1:8080/`, `http://localhost:3000/`). A public
domain whose DNS record points at loopback stays blocked — that is DNS
rebinding, not local development. Private, link-local, CGNAT and cloud
metadata ranges are never reachable, with or without this flag. Precedence:
user config → `KIGI_WEB_FETCH_ALLOW_LOCAL` → off.
`[toolset.ask_user_question]` is honored across **requirements.toml**, **managed
config**, and **user `config.toml`**. Precedence: requirements → env
(`KIGI_ASK_USER_QUESTION_TIMEOUT_ENABLED` /
crates/codegen/kigi-tui/src/slash/commands/effort_levels.rs
-1
View File
@@ -25,7 +25,6 @@ pub(crate) fn effort_description(level: ReasoningEffort) -> &'static str {
ReasoningEffort::High => "Heavy reasoning",
ReasoningEffort::Xhigh => "Extra-heavy reasoning",
ReasoningEffort::Max => "Maximum reasoning",
ReasoningEffort::Ultra => "Ultra reasoning",
}
}
crates/codegen/kigi-workspace/src/session/tool_config.rs
+3
View File
@@ -325,6 +325,9 @@ fn build_web_fetch_config() -> kigi_tools::implementations::kigi::web_fetch::Web
if let Ok(proxy) = std::env::var("KIGI_WEB_FETCH_PROXY") {
params.proxy_endpoint = Some(proxy);
}
if kigi_config::env_bool("KIGI_WEB_FETCH_ALLOW_LOCAL") == Some(true) {
params.allow_local = Some(true);
}
WebFetchConfig::Enabled { params }
}
#[cfg(any(test, feature = "test-support"))]