feat: multi-instance session lease, write fencing, and fs/watch reliability

.changeset/fix-ipv6-web-origin.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix `kimi web` startup when binding to an IPv6 host.

.changeset/journal-fswatch-reliability-fixes.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix `.gitignore` edits not taking effect until restart for file listing and file watching.

.changeset/multi-instance-session-sync.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: When several server instances share one home, opening a session held by another instance now redirects to that instance, and the session list refreshes automatically when a peer adds or removes sessions.

.changeset/reexport-kernel-file-lock-hook.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/agent-core-v2": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Re-export the kernel file lock binding hook from the agent engine so the CLI no longer depends on the internal lock package directly.

.changeset/session-event-release-barrier.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: Restore live event delivery after archiving and reopening a session.

.changeset/session-lease-write-fencing.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Opening the same session from a second instance now fails with a clear ownership error, while shutdown blocks late writes and releases ambiguous closes through a dirty fallback.

.changeset/skill-hot-reload.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Newly added or updated skills now take effect on the next turn without restarting, and the web skill list refreshes automatically.

.changeset/stale-write-fencing.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Each agent now tracks its own file-read baselines and refuses to overwrite files that changed on disk after its last read.

apps/kimi-code/.gitignore

@@ -8,4 +8,4 @@ agents/
 src/generated/vis-web-asset.ts
 
 # Copied from packages/pi-tui/native at build time by scripts/copy-native-assets.mjs
-native/
+/native/

apps/kimi-code/package.json

@@ -77,6 +77,9 @@
     "e2e:real": "pnpm -w run build:packages && KIMI_E2E_REAL=1 vitest run test/e2e/real-llm-smoke.e2e.test.ts",
     "postinstall": "node scripts/postinstall.mjs"
   },
+  "dependencies": {
+    "fs-native-extensions": "1.5.0"
+  },
   "optionalDependencies": {
     "@mariozechner/clipboard": "^0.3.9",
     "node-pty": "^1.1.0"

apps/kimi-code/scripts/native/check-bundle.mjs

@@ -23,7 +23,7 @@ const optionalRuntimeRequires = new Set([
   'utf-8-validate',
 ]);
 const optionalRelativeRuntimeRequires = new Set(['./crypto/build/Release/sshcrypto.node']);
-const handledNativeRuntimeRequires = new Set();
+const handledNativeRuntimeRequires = new Set(['fs-native-extensions']);
 
 function isAllowedSpecifier(specifier) {
   if (builtins.has(specifier) || specifier.startsWith('node:')) return true;

apps/kimi-code/scripts/native/native-deps.mjs

@@ -39,6 +39,15 @@ const piTuiNativeFileByTarget = Object.freeze({
   'win32-x64': ['native/win32/prebuilds/win32-x64/win32-console-mode.node'],
 });
 
+const fsNativeExtensionsFileByTarget = Object.freeze(
+  Object.fromEntries(
+    SUPPORTED_TARGETS.map((target) => [
+      target,
+      [`prebuilds/${target}/fs-native-extensions.node`],
+    ]),
+  ),
+);
+
 export function isSupportedTarget(target) {
   return SUPPORTED_TARGETS.includes(target);
 }
@@ -84,6 +93,13 @@ export const nativeDeps = Object.freeze([
     parent: null,
     nativeFileRelatives: (target) => piTuiNativeFileByTarget[target] ?? [],
   },
+  {
+    id: 'fs-native-extensions',
+    name: () => 'fs-native-extensions',
+    collect: 'native-file-only',
+    parent: null,
+    nativeFileRelatives: (target) => fsNativeExtensionsFileByTarget[target] ?? [],
+  },
 ]);
 
 /**

apps/kimi-code/src/cli/sub/web/run.ts

@@ -41,6 +41,7 @@ import {
   DEFAULT_SERVER_HOST,
   DEFAULT_SERVER_PORT,
   parseServerOptions,
+  serverOrigin,
   tryResolveServerToken,
   VALID_LOG_LEVELS,
   type ParsedServerOptions,
@@ -288,7 +289,7 @@ async function runServerInProcess(
   });
   logger.info('serving the REST/WS API and the bundled web UI');
   running = {
-    address: `http://${v2.host}:${v2.port}`,
+    address: serverOrigin(v2.host, v2.port),
     logger,
     close: () => v2.close(),
   };

apps/kimi-code/src/cli/sub/web/shared.ts

@@ -7,13 +7,14 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-import type { ServerLogLevel } from '@moonshot-ai/kap-server';
+import { formatServerOrigin, type ServerLogLevel } from '@moonshot-ai/kap-server';
 
 export const LOCAL_SERVER_HOST = '127.0.0.1';
 export const DEFAULT_LAN_HOST = '0.0.0.0';
 export const DEFAULT_SERVER_HOST = LOCAL_SERVER_HOST;
 export const DEFAULT_SERVER_PORT = 58627;
-export const DEFAULT_SERVER_ORIGIN = serverOrigin(DEFAULT_SERVER_HOST, DEFAULT_SERVER_PORT);
+export const DEFAULT_SERVER_ORIGIN = formatServerOrigin(DEFAULT_SERVER_HOST, DEFAULT_SERVER_PORT);
+export { formatServerOrigin as serverOrigin };
 
 /** Filename (under KIMI_CODE_HOME) of the persistent server bearer token. */
 export const SERVER_TOKEN_FILE = 'server.token';
@@ -112,10 +113,6 @@ export function parseLogLevel(raw: string | undefined): ServerLogLevel {
   );
 }
 
-export function serverOrigin(host: string, port: number): string {
-  return `http://${host}:${port}`;
-}
-
 /** Strip `/api/v1` and trailing slashes so user-supplied origins are uniform. */
 export function normalizeServerOrigin(value: string): string {
   const url = new URL(value);

apps/kimi-code/src/main.ts

@@ -36,6 +36,7 @@ import { runUpdatePreflight } from './cli/update/preflight';
 import { createKimiCodeHostIdentity, getVersion } from './cli/version';
 import { CLI_SHUTDOWN_TIMEOUT_MS, CLI_UI_MODE, PROCESS_NAME } from './constant/app';
 import { cleanupStaleNativeCacheForCurrent } from './native/native-assets';
+import { installKernelFileLockNativeBinding } from './native/kernel-file-lock';
 import { installNativeModuleHook } from './native/module-hook';
 import { runNativeAssetSmokeIfRequested } from './native/smoke';
 
@@ -142,6 +143,7 @@ export function main(): void {
   // invalid proxy URL is reported and ignored rather than aborting startup.
   installGlobalProxyDispatcher();
   installNativeModuleHook();
+  installKernelFileLockNativeBinding();
   if (runNativeAssetSmokeIfRequested()) return;
 
   // Start the background cleanup of stale native cache. Fire-and-forget; must not block startup or throw.

apps/kimi-code/src/native/kernel-file-lock.ts

@@ -0,0 +1,44 @@
+import { join } from 'node:path';
+
+import {
+  setKernelFileLockBindingLoader,
+  type KernelFileLockBinding,
+} from '@moonshot-ai/agent-core-v2';
+
+import { loadNativePackageFile } from './native-require';
+
+interface NativeFileLockBinding {
+  tryLock(fd: number, offset: number, length: number, exclusive: boolean): void;
+  unlock(fd: number, offset: number, length: number): void;
+}
+
+function errorCode(error: unknown): string | undefined {
+  return (error as NodeJS.ErrnoException | undefined)?.code;
+}
+
+export function loadKernelFileLockNativeBinding(): KernelFileLockBinding | undefined {
+  const target = `${process.platform}-${process.arch}`;
+  const binding = loadNativePackageFile<NativeFileLockBinding>(
+    'fs-native-extensions',
+    join('prebuilds', target, 'fs-native-extensions.node'),
+  );
+  if (binding === null) return undefined;
+  return {
+    tryLock: (fd) => {
+      try {
+        binding.tryLock(fd, 0, 0, true);
+        return true;
+      } catch (error) {
+        if (errorCode(error) === 'EAGAIN') return false;
+        throw error;
+      }
+    },
+    unlock: (fd) => {
+      binding.unlock(fd, 0, 0);
+    },
+  };
+}
+
+export function installKernelFileLockNativeBinding(): void {
+  setKernelFileLockBindingLoader(loadKernelFileLockNativeBinding);
+}

apps/kimi-code/src/native/native-require.ts

@@ -28,3 +28,13 @@ export function loadNativePackage<T>(
   if (nativeRequire === null) return null;
   return nativeRequire(packageName) as T;
 }
+
+export function loadNativePackageFile<T>(
+  packageName: string,
+  relativePath: string,
+  options: NativeAssetOptions = {},
+): T | null {
+  const packageRoot = getNativePackageRoot(packageName, options);
+  if (packageRoot === null) return null;
+  return createRequire(import.meta.url)(join(packageRoot, relativePath)) as T;
+}

apps/kimi-code/src/native/smoke.ts

@@ -2,8 +2,9 @@ import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 
 import { getEmbeddedNativeAssetManifest, getNativePackageRoot } from './native-assets';
+import { loadKernelFileLockNativeBinding } from './kernel-file-lock';
 
-const smokePackages = ['@mariozechner/clipboard', '@moonshot-ai/pi-tui'];
+const smokePackages = ['@mariozechner/clipboard', '@moonshot-ai/pi-tui', 'fs-native-extensions'];
 
 // Verify pi-tui's native helper can actually be loaded through the module hook.
 // pi-tui computes native helper paths from process.execPath and require()s them;
@@ -34,6 +35,13 @@ function smokePiTuiNativeLoad(): void {
   }
 }
 
+function smokeKernelFileLockNativeLoad(): void {
+  const binding = loadKernelFileLockNativeBinding();
+  if (binding === undefined) {
+    throw new Error('fs-native-extensions binding is unavailable.');
+  }
+}
+
 export function runNativeAssetSmokeIfRequested(): boolean {
   if (process.env['KIMI_CODE_NATIVE_ASSET_SMOKE'] !== '1') return false;
 
@@ -49,6 +57,7 @@ export function runNativeAssetSmokeIfRequested(): boolean {
       }
     }
     smokePiTuiNativeLoad();
+    smokeKernelFileLockNativeLoad();
     process.stdout.write(`Native asset smoke passed: ${manifest.target}\n`);
     process.exit(0);
   } catch (error) {

apps/kimi-code/test/cli/web/web.test.ts

@@ -18,7 +18,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { registerWebCommand } from '#/cli/sub/web';
 import type { LegacyKillDeps } from '#/cli/sub/web/legacy-kill';
 import type { WebCommandDeps } from '#/cli/sub/web/run';
-import type { ParsedServerOptions } from '#/cli/sub/web/shared';
+import { serverOrigin, type ParsedServerOptions } from '#/cli/sub/web/shared';
 import { darkColors } from '#/tui/theme/colors';
 
 vi.mock('node:child_process', async (importOriginal) => {
@@ -952,6 +952,15 @@ describe('formatHostForUrl', () => {
   });
 });
 
+describe('serverOrigin', () => {
+  it('bracket-wraps an IPv6 host so the origin remains parseable', () => {
+    const origin = serverOrigin('::1', 58627);
+
+    expect(origin).toBe('http://[::1]:58627');
+    expect(new URL(origin).port).toBe('58627');
+  });
+});
+
 describe('filterDisplayAddresses', () => {
   it('drops IPv6 link-local, de-duplicates, and orders IPv4 before IPv6', async () => {
     const { filterDisplayAddresses } = await import('#/cli/sub/web/networks');

apps/kimi-code/test/native/native-assets.test.ts

@@ -12,7 +12,7 @@ import {
   type NativeAssetManifest,
   type NativeAssetSource,
 } from '#/native/native-assets';
-import { loadNativePackage } from '#/native/native-require';
+import { loadNativePackage, loadNativePackageFile } from '#/native/native-require';
 
 function sha256(bytes: Buffer | string): string {
   return createHash('sha256').update(bytes).digest('hex');
@@ -125,4 +125,30 @@ describe('native assets', () => {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  it('loads a package file from extracted native assets', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'kimi-native-file-require-'));
+    try {
+      const { manifest, source } = fakeManifest({
+        'node_modules/fake-native/package.json': '{}',
+        'node_modules/fake-native/prebuilds/test-target/addon.cjs':
+          "module.exports = { value: 'native' };\n",
+      });
+
+      const addon = loadNativePackageFile<{ value: string }>(
+        'fake-native',
+        join('prebuilds', 'test-target', 'addon.cjs'),
+        {
+          cacheBase: dir,
+          manifest,
+          source,
+          version: 'test',
+        },
+      );
+
+      expect(addon).toEqual({ value: 'native' });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });

apps/kimi-code/test/scripts/native/native-deps.test.ts

@@ -42,6 +42,7 @@ describe('resolveTargetDeps', () => {
     expect(names).toContain('@mariozechner/clipboard');
     expect(names).toContain('@mariozechner/clipboard-darwin-arm64');
     expect(names).toContain('@moonshot-ai/pi-tui');
+    expect(names).toContain('fs-native-extensions');
   });
 
   it('picks the right clipboard subpackage per target', () => {
@@ -75,6 +76,15 @@ describe('resolveTargetDeps', () => {
     ]);
   });
 
+  it('encodes fs-native-extensions prebuild path per target', () => {
+    const fsNative = resolveTargetDeps('linux-x64').find(
+      (d) => d.resolvedName === 'fs-native-extensions',
+    );
+    expect(fsNative?.nativeFileRelatives).toEqual([
+      'prebuilds/linux-x64/fs-native-extensions.node',
+    ]);
+  });
+
   it('throws on unsupported target', () => {
     expect(() => resolveTargetDeps('linux-x64-musl')).toThrow(/unsupported/i);
   });
@@ -97,4 +107,10 @@ describe('nativeDeps registry shape', () => {
     expect(piTui?.collect).toBe('native-file-only');
     expect(piTui?.parent).toBe(null);
   });
+
+  it('has fs-native-extensions (collect=native-file-only, no parent)', () => {
+    const fsNative = nativeDeps.find((d) => d.id === 'fs-native-extensions');
+    expect(fsNative?.collect).toBe('native-file-only');
+    expect(fsNative?.parent).toBe(null);
+  });
 });

apps/kimi-code/tsdown.native.config.ts

@@ -16,7 +16,7 @@ const builtins = new Set([
   ...builtinModules,
   ...builtinModules.map((name) => `node:${name}`),
 ]);
-const optionalNativeDependencies = new Set(['cpu-features']);
+const optionalNativeDependencies = new Set(['cpu-features', 'fs-native-extensions']);
 
 function shouldAlwaysBundle(id: string): boolean {
   if (builtins.has(id) || id.startsWith('node:')) return false;

apps/kimi-web/src/api/daemon/client.ts

@@ -1463,8 +1463,16 @@ export class DaemonKimiWebApi implements KimiWebApi {
         handlers.onConnectionChange(connected);
       },
 
-      onError: (code: number, msg: string, fatal: boolean) => {
-        handlers.onError(code, msg, fatal);
+      onError: (code: number, msg: string, fatal: boolean, details?: unknown) => {
+        handlers.onError(code, msg, fatal, details);
+      },
+
+      onSessionListChanged: () => {
+        handlers.onSessionListChanged?.();
+      },
+
+      onSkillCatalogChanged: (sessionId: string) => {
+        handlers.onSkillCatalogChanged?.(sessionId);
       },
 
       onTerminalOutput: (sessionId, terminalId, data, seq) => {