# Kimi Code CLI

Kimi Code CLI and chock: install methods and steps, what it can enforce, and the evidence behind it.

Install methods: plugin. Agentseam tier block, grade best-effort before a tool runs.

> Ask the user before running any command on this page: each one changes how their agent or repository behaves.

## Install methods

- Plugin: `chock install --client kimi-code` (ask the user before running it)
- Not wired by chock sync: this agent reads its hooks from a config in your home folder, and chock sync writes only inside the repository.

## Install steps

### Kimi Code (kimi-code)

State: untested.

Evidence wanted for Kimi Code. Chock has not seen Kimi Code run the plugin yet. The command still builds the plugin. If you use Kimi Code, you can help: run it and share what happens in [agentseam issue #135](https://github.com/open-coder-ai/agentseam/issues/135).

The command (ask the user before running it: it builds a plugin of hooks that change how their agent behaves):

    chock install --selection <code> --client kimi-code

Then, in Kimi Code:

Kimi Code installs plugins from its TUI only, and chock does not drive it: in Kimi Code run `/plugins install ~/.chock/marketplace/kimi-code/chock-guardrails`, then `/reload` (or `/new`). Kimi copies the plugin to $KIMI_CODE_HOME/plugins/managed/chock-guardrails/ and runs that copy, so after a rebuild install it again. The plugin applies to every project you open (Kimi has no project-level plugin scope); `/plugins disable chock-guardrails` turns it off.

## What it can enforce

- Tier: block
- Grade before a tool runs: best-effort
- Fail mode before a tool runs: open
- Basis: vendor-docs
- Recorded: 2026-08-26

## Events

| Event | Can block | Can rewrite | Fail mode |
| --- | --- | --- | --- |
| pre_tool | yes | no | open |
| post_tool | no | no | open |
| tool_failure | no | no | open |
| prompt_submit | yes | no | open |
| session_start | no | no | open |
| session_end | no | no | open |
| subagent_start | no | no | open |
| subagent_stop | no | no | open |
| stop | yes | no | open |
| pre_compact | no | no | open |

## Ask support

The engine records no ask claim for this agent.

## Hook timeout

The engine records no timeout for this agent.

## Test status

- Plugin (kimi-code): untested.
- No row in the engine's list of live tests for this agent.

## Known limits

Twenty events, of which exactly three block: PreToolUse, UserPromptSubmit and Stop. The rest are documented as fire-and-forget, so a decision returned there changes nothing. Accepts Claude Code's hookSpecificOutput.permissionDecision shape, and exit 2 blocks too -- but the JSON form carries the reason back into the model's context. Read from the source, not inferred from Claude Code: MoonshotAI/kimi-code@b510fa9 packages/agent-core-v2/src/features/externalHooks/internal/runHook.ts parses every event's output alike, blocking on exit 2 or, at exit 0, on hookSpecificOutput.permissionDecision "deny" (a top-level decision is never read), and agentExternalHooksService.ts consumes that block at PreToolUse, UserPromptSubmit and Stop (read 2026-10-13), so all three gates are real. No rewrite. Config is TOML ([[hooks]] in config.toml, four fields only; a fifth makes the whole file fail to load), so installation appends a marker-delimited block rather than rewriting the user's settings. Fails OPEN, and the vendor says outright that hooks here are not a sole security barrier. Only client_type separates its payloads from Claude Code's.


---

Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).