v1.0.1 — kimi-code 0.3.0 and 0.4.0 compat

What changed

Extends KIMI_TESTED_MINORS to include kimi-code 0.3 and 0.4 after the 2026-05-27 four-reviewer compat audit (marker tag compat-verified-kimi-code-0.4.0) verified that kimi-code 0.4.0 preserves every surface kimi-plugin-cc consumes.

Why this release

Between v1.0.0 and now, kimi-code shipped 0.3.0 (mostly TUI) and 0.4.0 (PR #26 reworked the entire permission system into an ordered policy queue). After auditing both, /kimi:setup was still warning users on those versions — versions we had explicitly verified — which read as a contradiction. v1.0.1 closes that UX gap.

Compatibility

• All runtime semantics unchanged
• Hook contract, stream-json parsing, CLI invocation: all unchanged
• PR #26's policy queue refactor: PreToolCallHookPermissionPolicy still at index 0 in packages/agent-core/src/agent/permission/policies/index.ts, runs before auto-mode-approve (4) and yolo-mode-approve (13). Our safety hook still fires first.
• kimi -p still hard-codes permission: 'auto'; resumed sessions still force-overridden to 'auto'
• All argv flags we invoke (-p, -r, --output-format stream-json, -m, --skills-dir) unchanged
• packages/agent-core/src/agent/hooks/ is byte-identical 0.2.0→0.4.0 (0-byte diff)
• apps/kimi-code/src/cli/run-prompt.ts is byte-identical 0.2.0→0.4.0; session.resume_hint shape unchanged

Files changed

• runtime/kimi-version-probe.ts: KIMI_TESTED_MINORS now [{0,1},{0,2},{0,3},{0,4}]
• tests/runtime/kimi-version-probe.test.ts: assertions extended; canary now uses 0.5 as unknown-minor
• Five-file version bump: runtime/version.ts, package.json, .claude-plugin/plugin.json, .claude-plugin/marketplace.json, AGENTS.md
• ROADMAP-TO-GA.md: H6 audit log records the extension and the sequencing tradeoff

Audit playbook

The routine that produced this release is codified at docs/upstream-compat-audit.md. When a new kimi-code release lands, run that playbook before extending KIMI_TESTED_MINORS or tagging a new compat marker.

Test state

• 391 tests pass (1004 expect() calls)
• Drift gate clean
• Pre-built dist/ committed (zero-build install)

What's NOT in this release

H7 (real-binary CI smoke against pinned kimi-code releases) remains v1.1 work. The audit recommendation to defer extending KIMI_TESTED_MINORS until H7 lands still stands as the strict reading; this release prioritizes user-visible UX over that sequencing. H7 will retroactively strengthen this claim with CI enforcement.

H8 (surface installed kimi-code plugins at setup) and H9 (pin known-good upper bound) also remain v1.1 work — see ROADMAP-TO-GA.md.