Kimi Code CLI

Install methods

• Plugin: chock install --client kimi-code (ask the user before running it)
• Not wired by chock sync: this agent reads its hooks from a config in your home folder, and chock sync writes only inside the repository.

Install steps

Kimi Code (kimi-code)

Untested

The command (ask the user before running it: it builds a plugin of hooks that change how their agent behaves):

chock install --selection <code> --client kimi-code

Then, in Kimi Code:

Kimi Code installs plugins from its TUI only, and chock does not drive it: in Kimi Code run /plugins install ~/.chock/marketplace/kimi-code/chock-guardrails, then /reload (or /new). Kimi copies the plugin to $KIMI_CODE_HOME/plugins/managed/chock-guardrails/ and runs that copy, so after a rebuild install it again. The plugin applies to every project you open (Kimi has no project-level plugin scope); /plugins disable chock-guardrails turns it off.

What it can enforce

Tier

block

Grade before a tool runs

best-effort

Fail mode before a tool runs

open

Basis

vendor-docs

Recorded

2026-08-26

Events

Ask support

The engine records no ask claim for this agent.

Hook timeout

The engine records no timeout for this agent.

Test status

• Plugin (kimi-code): untested.
• No row in the engine's list of live tests for this agent.

Known limits

Twenty events, of which exactly three block: PreToolUse, UserPromptSubmit and Stop. The rest are documented as fire-and-forget, so a decision returned there changes nothing. Accepts Claude Code's hookSpecificOutput.permissionDecision shape, and exit 2 blocks too -- but the JSON form carries the reason back into the model's context. Read from the source, not inferred from Claude Code: MoonshotAI/kimi-code@b510fa9 packages/agent-core-v2/src/features/externalHooks/internal/runHook.ts parses every event's output alike, blocking on exit 2 or, at exit 0, on hookSpecificOutput.permissionDecision "deny" (a top-level decision is never read), and agentExternalHooksService.ts consumes that block at PreToolUse, UserPromptSubmit and Stop (read 2026-10-13), so all three gates are real. No rewrite. Config is TOML ([[hooks]] in config.toml, four fields only; a fifth makes the whole file fail to load), so installation appends a marker-delimited block rather than rewriting the user's settings. Fails OPEN, and the vendor says outright that hooks here are not a sole security barrier. Only client_type separates its payloads from Claude Code's.