/adversarial-review

Kimi Adversarial Review

EXTERNAL_MODEL_CONTRACT_VERSION=1

$ARGUMENTS is optional --scope-base REF, optional --timeout-ms MS, and focus text. If present, pass --scope-base REF as a CLI flag; write the remaining focus text to the private prompt file referenced by RELAY_PROMPT_FILE. Preserve raw $ARGUMENTS exactly except for routing documented flags. Review timeout defaults to 900000 ms. Use --timeout-ms <ms> or KIMI_REVIEW_TIMEOUT_MS; the effective value is persisted in review_metadata.audit_manifest.request.timeout_ms. Route --max-steps-per-turn N as a CLI flag before --prompt-file; N must be a positive integer.

Prompt payload: Write the routed focus text to a private temp file (mode 0600), set RELAY_PROMPT_FILE to that path, and delete it after the command exits.

Run:

• node "${CLAUDE_PLUGIN_ROOT}/scripts/relay-run.mjs" kimi-companion.mjs run --mode=adversarial-review --foreground --lifecycle-events markdown --prompt-file "$RELAY_PROMPT_FILE"

Review Contract

This is a review-only contract. Do not fix findings, apply patches, edit files, or start rescue work from a review result. Preserve the caller's review text verbatim after routing documented flags. Return the runtime output verbatim; do not summarize or rewrite findings. If there is no substantive result or structured output, report review blocked / no findings produced. Render external_review_launched as soon as it appears. Render external_review before findings, status prose, or the review result. Render findings first, ordered by severity. Keep blocking and non-blocking findings distinct. Surface mutations prominently and do not auto-revert them.

Use custom-review for explicit file bundles. Scope validation must complete before selected source is sent. If concrete files or --scope-paths are already known, do not run branch-diff first; use custom-review with those paths and the original prompt.

Rendering Contract

Request --lifecycle-events markdown for foreground and background review flows. Render lifecycle markdown cards directly. If a legacy JSON lifecycle envelope appears, render external_review_launched immediately. external_review_progress is a heartbeat for long foreground runs; keep the existing launch card visible and do not render it as a terminal result. If a background launch envelope has event: "launched" with an external_review field, render the same launch card immediately with session pending. If a legacy JSON external_review field appears, render it before normal prose. Lifecycle cards should include provider, job, session, run kind, mode, scope, source transmission, source bearing, selected route, fallback reason, auth path, billing path, source-send approval state, approval scope, review quality, status, error code, error message, HTTP status, and suggested action when those fields are present.

### EXTERNAL REVIEW

| Field | Value |
| --- | --- |
| Provider | <provider> |
| Job | <job_id> |
| Session | <session_id or pending> |
| Run | <foreground|background|unknown> |
| Mode | <mode> |
| Scope | <scope and scope_base/scope_paths> |
| Source | <source_content_transmission> |
| Source Bearing | <source_bearing> |
| Route | <selected_route> |
| Fallback | <fallback_reason> |
| Auth | <auth_path> |
| Billing | <billing_path> |
| Approval | <source_send_approval_state / approval_scope> |
| Review Quality | <review_quality.failed_review_slot / review_quality.semantic_failure_reasons> |
| Status | <status> |
| Error | <error_code> |
| Message | <error_message> |
| HTTP | <http_status> |
| Action | <suggested_action> |

Scope Safety

A git worktree can filter gitignored files before selected source is sent. A non-git directory cannot rely on gitignore filtering; distinguish non-git source directories from paths inside a git worktree. Preflight scope failures such as scope_base_missing, scope_base_invalid, scope_requires_git, scope_requires_head, scope_paths_required, and scope_empty happen before external source transmission and should report source_content_transmission: "not_sent".

Secret Safety

Do not print raw OAuth tokens, API-key values, session cookies, tunnel API keys, bearer tokens, or raw secret values. Credential diagnostics may show key names only.

This command is emitted for the Claude relay plugin.