diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index fa0ca86..dc54678 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -17,8 +17,8 @@
     {
       "name": "work-system",
       "source": "./plugins/work-system",
-      "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, or grok), and track progress across the define/kickoff/continue/status/close lifecycle.",
-      "version": "1.10.0"
+      "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, grok, or kimi), and track progress across the define/kickoff/continue/status/close lifecycle.",
+      "version": "1.11.0"
     },
     {
       "name": "pr-flow",
diff --git a/.claude/knowledge/_index.md b/.claude/knowledge/_index.md
index 7a05672..30ad4f7 100644
--- a/.claude/knowledge/_index.md
+++ b/.claude/knowledge/_index.md
@@ -16,7 +16,7 @@
 - `features/lane-registry.md` — `lanes.sh` + `herdr-agent.sh` (Wave 1): the one herdr-agent wrapper (degrade-not-block, bounded wait) + centralized `$HERDR_MATCH_PRELUDE` cwd↔worktree match (consumed by herdr-tab-glyph, regression-guarded via live snapshot); lanes.sh joins states+liveness keyed by worktree_path with a worktree-tab-state degrade tri-state; env test-seams for hermetic join tests
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
 - `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) + main-root `◉` on herdr tab labels: `states` mode in the self-contained renderer, sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
-- `features/kickoff-agent-selection.md` — `/kickoff` worker choice: single committed per-repo default (no global/fallback/ranking) else picker; `agent-registry.sh` as SoT; bounded model-aware grok probe (inconclusive→trust-auth); non-claude "document, don't fake" degradation; announce-not-prompt for external defaults
+- `features/kickoff-agent-selection.md` — `/kickoff` worker choice: single committed per-repo default (no global/fallback/ranking) else picker; `agent-registry.sh` as SoT; bounded model-aware grok/kimi probes (inconclusive→trust-auth); kimi's two-phase seed+continue argv + `argv_shell=`; non-claude "document, don't fake" degradation; announce-not-prompt for external defaults
 - `features/task-archiving-on-close.md` — `/close` archives (not deletes) the task file; adaptive commit + ff-push to main; per-repo `.claude/work-system-close-autocommit` opt-in skips the ask
 - `features/swarm-backend-adapter.md` — 0.6.0 read+web posture: OS secret-jail (denylist, worktree-aware, git-config-safe), per-voice fail-closed degrade, `jail` verb, prompt egress guard + residual risks; plus verified codex/grok CLI facts (schema JSON, effort mapping, model-aware readiness)
 - `features/swarm-review-pipeline.md` — `/swarm:review` pipeline: skill↔Workflow wiring, family-consensus, 0.5.0 lens clusters + design-kind verify, `--fix`/`--loop` (deterministic close-out via `loop-closeout.py`), `--pr` publish via deterministic `pr-post.py`
diff --git a/.claude/knowledge/architecture/manager-worker-orchestration.md b/.claude/knowledge/architecture/manager-worker-orchestration.md
index 081455f..6aa798d 100644
--- a/.claude/knowledge/architecture/manager-worker-orchestration.md
+++ b/.claude/knowledge/architecture/manager-worker-orchestration.md
@@ -20,7 +20,7 @@ implementation is spawned across tasks `add-lane-registry`, `spike-agent-mail-su
 - **Manager** = the Claude Code session at the main repo root (herdr `◉` tab). A
   *coordinator*, not a merge robot — the human stays merge authority unless
   explicitly delegated at kickoff.
-- **Worker** = one {claude|codex|grok} session per worktree, driving its task to a
+- **Worker** = one {claude|codex|grok|kimi} session per worktree, driving its task to a
   reviewed, mergeable PR.
 - **Lane** = `(worktree_path, task, branch)`. **Identity = worktree_path** — the one
   key stable across agent types and restarts. herdr pane/tab, `agent_status`,
diff --git a/.claude/knowledge/features/herdr-kickoff-automation.md b/.claude/knowledge/features/herdr-kickoff-automation.md
index 6354514..0a22612 100644
--- a/.claude/knowledge/features/herdr-kickoff-automation.md
+++ b/.claude/knowledge/features/herdr-kickoff-automation.md
@@ -35,7 +35,10 @@ truth; this entry captures the durable design and one non-obvious gotcha.
   `claude --model <m> -n "<label>" "/work-system:continue"` (plugin-qualified — see
   the shadowing gotcha below), while codex/grok get their own
   `-m` form — `codex -m <model> "<bootstrap prompt>"` /
-  `grok -m <model> "<bootstrap prompt>"` (see [[kickoff-agent-selection]]).
+  `grok -m <model> "<bootstrap prompt>"`, and kimi (1.11.0) a two-phase
+  `sh -c 'kimi -m "$1" -p "$2" || …; exec kimi -c --auto' …` — it has no positional
+  launch prompt (see [[kickoff-agent-selection]]). `emit_argv` is the SoT; never
+  reconstruct an argv from this list.
   herdr-launch stays CLI-agnostic — it just execs the resolved `argv=` words. The
   `-- argv` form sidesteps the interactive shell entirely, so there is no keystroke
   race against shell startup (see the gotcha below) and no readiness handshake to
diff --git a/.claude/knowledge/features/kickoff-agent-selection.md b/.claude/knowledge/features/kickoff-agent-selection.md
index bc80fed..9a9551f 100644
--- a/.claude/knowledge/features/kickoff-agent-selection.md
+++ b/.claude/knowledge/features/kickoff-agent-selection.md
@@ -1,10 +1,10 @@
 ---
 title: "Kickoff Agent Selection: registry, per-repo default, honest degradation"
 createdAt: 2026-07-17
-updatedAt: 2026-07-17
+updatedAt: 2026-08-05
 createdFrom: "session: 2026-07-17 (task/kickoff-agent-selection)"
-updatedFrom: "session: 2026-07-17"
-pluginVersion: 1.9.0
+updatedFrom: "session: 2026-08-05 (task/add-kimi-worker-support, post-swarm)"
+pluginVersion: 1.11.0
 prime: false
 ---
 
@@ -25,7 +25,7 @@ nothing more. `--pick` forces the picker even when a default exists.
 
 ## Registry is the single source of truth
 `scripts/agent-registry.sh` owns aliases (`--fable`/`--opus`/`--codex`/`--sol`/
-`--grok`/`--agent cli[:model]`), the launch argv per CLI, availability, and
+`--grok`/`--kimi`/`--agent cli[:model]`), the launch argv per CLI, availability, and
 `default get`/`set`. `herdr-launch.sh` stays CLI-agnostic: it execs the resolved
 `argv=` words (argv-exec, no shell-typing race — same reason as the kickoff
 launch). Skills never hardcode the CLI list. `default get` **validates** its
@@ -43,16 +43,80 @@ never hangs. A failed *or* empty-but-successful (reformatted) `grok models` is
 or format drift must not disable the backend. codex/claude stay auth-only (no
 clean model-list command). See [[swarm-backend-adapter]] for the sibling probe.
 
+## kimi: the launch shape a CLI's flags can force on you
+kimi (added 1.11.0, `--kimi` → `kimi:kimi-code/k3-256k`) is the first worker whose
+argv is not `<cli> -m <model> <prompt>`, because **no such form exists**. Probed
+live on 0.31.1: no positional launch prompt (`kimi "text"` → "unknown command"),
+no initial-prompt env var, and piped stdin only prefills the input box without
+submitting — and in a pane it would steal the TUI's tty anyway. `-p` is the sole
+entry point but is mutually exclusive with **both** `--auto` and `-y` and exits
+after one answer, so it cannot *be* the worker. What makes it work: `-p` runs
+tools unattended, and `kimi -c` inherits its session history. Hence two phases:
+
+    sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' \
+       kimi-worker <model> <prompt>        # exact text: KIMI_LAUNCH_SCRIPT
+
+`exec` re-roots the pane at kimi (herdr then watches the real process). A failed
+seed must neither kill the pane (`&&`) nor pass unnoticed (a bare `;` — the TUI's
+first repaint scrolls the error away, leaving a tab that looks like a working
+worker but never read TASK.md), so the script **reports and waits for a keypress**
+before handing over. Verified: a failed seed in a fresh worktree yields a NEW empty
+session, never a foreign one — `kimi -c` is scoped to the working directory, so two
+worktrees cannot cross-resume. Values ride as
+`"$1"`/`"$2"` positionals, never spliced into the script text — `-p` swallows the
+next token, so a concatenated argv is one reordering away from silently eating a
+flag (`kimi -p --auto "…"` makes `--auto` the prompt). The test asserts the exact
+word list *and* executes the argv against a logging stub, because string checks
+can't prove the shell binds values the way you think. Two more traps: `-m` needs
+the **qualified** alias (`kimi-code/k3-256k`; the bare name aborts at startup like
+an unknown model — hence model-aware readiness), and auth lives in
+`credentials/`, not the same-named `oauth/` dir, which stays 0 bytes when logged
+in. `kimi doctor` only validates config syntax; it is not an auth check.
+
+**JSON breaks grok's "empty = inconclusive" rule.** grok treats empty output as
+drift and trusts auth. For kimi's `provider list --json`, `{"models": {}}` is
+non-empty yet a *real* "no models" answer. So the gate is the **section's
+presence**: no `"models"` key → drift → trust auth; present but no match → truly
+unavailable. Transplanting the sibling's rule verbatim would have mislabeled
+either case.
+
+## kimi's unattended posture is a decision, not an oversight
+kimi is the only worker without tool-approval prompts: the seed can't have them
+(`-p` refuses `--auto`/`-y`, and `-p` is the only way to deliver the task) and
+phase 2 opts into `--auto` because a worker should keep going. Reviewed twice as
+a security finding and **kept deliberately** (2026-08-05) — the mitigation is
+visibility, matching the announce-not-prompt precedent below: `/kickoff` states
+the unattended start whenever the worker resolves to kimi, `/adopt` additionally
+warns because its TASK.md is summarized from someone else's commits. Dropping
+`--auto` was rejected as a half-measure: it would leave the seed — the phase that
+does the work — just as unattended. If this is ever revisited, the real lever is
+a second registry entry (interactive `--kimi` vs. opt-in autonomous), not the
+`--auto` flag alone.
+
+## `argv_shell=`: quoting belongs to the registry, not to prose
+`resolve` emits, next to the `argv=` words, one `argv_shell=` line with the same
+words POSIX-single-quoted (`shell_quote`, not `printf %q` — bash 3.2 renders that
+as per-character backslashes and `$'…'` for non-ASCII: correct but unreadable and
+bash/zsh-only). The skills print that line **verbatim** for their outside-herdr
+block. Before this, quoting was a *prose rule* the model had to follow; for kimi
+that is safety-critical, because its argv carries `;` and `exec` — a mis-quoted
+render would run the `;` in the **user's own interactive shell** and replace it
+with an unattended agent. Same reason the seed message stays ASCII-only: any
+backslash escape or non-ASCII char forces the unreadable `$'…'` form.
+
 ## Non-claude degradation: document, don't fake
-codex/grok have no work-system skills, so a launched worker gets a bootstrap
+codex/grok/kimi have no work-system skills, so a launched worker gets a bootstrap
 prompt (read TASK.md → commit → PR) instead of `/continue`. Everything
 git/PR-derived (`/status`, `/list`, `[ws]` statusline, `/close` tab teardown)
-is CLI-agnostic. `/close` Scenario B (`/exit` self-teardown) is claude-only *by
+is CLI-agnostic — `agent_name` comes from the registry's `name=`, never argv[0],
+and `agent_status` from herdr's own pane hooks, so kimi's `sh -c` wrapper changes
+nothing. `/close` Scenario B (`/exit` self-teardown) is claude-only *by
 construction* (only a claude session can invoke `/close` from inside its tab).
 `/continue` reopen **always sends `claude -c`** — the worker is not persisted
-per task (per-task agent memory is a deliberate later idea), so for a codex/grok
-task the user resumes the real worker themselves; the skill surfaces this inline
-rather than pretending. `supports=` in the registry is **reserved** metadata
+per task (per-task agent memory is a deliberate later idea), so for a
+codex/grok/kimi task the user resumes the real worker themselves (`codex resume
+--last` / `grok -c` / `kimi -c`); the skill surfaces this inline rather than
+pretending. `supports=` in the registry is **reserved** metadata
 (the seed for the manager/worker-orchestration design) — not yet consumed.
 
 ## Security: announce, don't prompt
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8f6e295..2f5f217 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -52,6 +52,18 @@ entries are grouped per plugin, newest first.
 
 ## work-system
 
+### 1.11.0 — 2026-08-03
+- `/kickoff` can launch the **kimi CLI** (kimi-code) as a worker: `--kimi` → `kimi:kimi-code/k3-256k`, joining claude/codex/grok in `agent-registry.sh`. It appears in the picker and can be saved as the repo default, where it announces like the other third-party workers.
+- kimi is the first worker without a `<cli> -m <model> <prompt>` launch form — it has no positional launch prompt, no initial-prompt env var, and piped stdin only prefills the input box (and would steal the TUI's tty). Its `-p` flag is the only entry point, but it cannot be combined with `--auto`/`-y` and exits after one answer. Since `-p` does run tools unattended and `kimi -c` inherits its history, the launch is two-phase: `sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' …` — the seed works the task through once, then `exec` hands over to the interactive autonomous session. So a kimi tab has already made progress by the time you switch to it.
+- The model and prompt travel as `"$1"`/`"$2"` positionals rather than spliced into the script text: `-p` consumes the next token, so a concatenated argv can silently swallow a flag (`kimi -p --auto "…"` turns `--auto` into the prompt). Tests assert the exact word list, that structure, and — by executing the resolved argv against a logging stub — what each phase actually received.
+- Readiness is model-aware via `kimi provider list --json` (bounded), because an unconfigured `-m` id aborts kimi at startup; the id must be the **qualified** alias (`kimi-code/k3-256k`). Auth probes `credentials/kimi-code.json`, not the same-named `oauth/` file, which stays 0 bytes even when logged in. A listing without the `models` section counts as format drift and falls back to trusting auth, while a well-formed listing offering nothing means unavailable — grok's "empty output = inconclusive" rule doesn't transfer to JSON.
+- `/continue`'s reopen caveat and the README now name `kimi -c` alongside `codex resume --last` / `grok -c`. Lifecycle is unchanged: `agent_name` comes from the registry and `agent_status` from herdr's pane hooks, so the `sh -c` wrapper (which `exec`s into kimi) doesn't affect tab teardown or state.
+- `resolve` now also emits `argv_shell=` — the same words POSIX-single-quoted — and `/kickoff`/`/adopt` print that line verbatim in their outside-herdr block instead of re-deriving the quoting from a prose rule. For kimi this is safety-critical: its argv carries `;` and `exec`, so a mis-quoted render would run the `;` in the user's own interactive shell.
+- A failed kimi seed is no longer silent. `&&` would kill the pane and a bare `;` let the error scroll away behind the TUI's first repaint, leaving a tab that looked like a working worker; the launch script now reports the failure and waits for a keypress before handing over to an (empty) session. Covered by a test that runs the resolved argv against a stub whose seed exits non-zero.
+- kimi's model check matches the alias in **key** position (`"<model>":`) instead of anywhere in the document, so the alias appearing as a value (a `default_model`-style field) can't report an empty `models` set as available. The real listing is flat-qualified, verified live.
+- `/kickoff` announces kimi's **unattended** start (no tool-approval prompts in either phase) whenever the resolved worker is kimi, and `/adopt` warns additionally — its TASK.md is summarized from another branch's commits, so it is the one path where an unattended worker acts on content the user did not write. Announce, not prompt: the autonomy is the intended shape.
+- Selector surfaces swept for the new worker: `/kickoff`'s description + flag table, `/adopt`'s two selector enumerations and its manual-launch block (incl. the `sh -c` quoting caution), `/close`'s worker-degradation prose, `herdr-launch.sh`'s usage header, `plugin.json`'s description, and the `herdr-kickoff-automation` knowledge entry. `/kickoff`'s non-claude announce rule now tests "not `claude:`" instead of a per-CLI allowlist, so a future registry entry is covered without another edit.
+
 ### 1.10.0 — 2026-07-24
 - `/close` step 10's commit+push prompt is now skippable per repo: a committed `.claude/work-system-close-autocommit` flag (mirrors the `.claude/work-system-agent` default precedent) routes straight to `archive-task.sh commit-push` — no `AskUserQuestion` — and reports the result exactly as the manual path does. Off by default; unset repos keep today's ask-once behavior. Per-repo only, no global default. `archive-task.sh` grew an `autocommit get|set|unset` subcommand as the single source of truth for the flag.
 - The flag is honored **only once committed**: `get` reads the value from the committed object on the default branch (`git show refs/heads/<main-branch>:<rel>` — fully qualified, so a same-named tag cannot shadow the branch), never from the working tree, so a file a tool or a worktree agent merely wrote cannot waive the prompt — and neither can a working-tree edit hidden behind `git update-index --assume-unchanged`/`--skip-worktree`, which fools a diff-based guard. A locally edited flag still falls back to asking, so deliberate local disabling works. Scope stated honestly: this raises the bar from "any file write" to "a commit", not to "human-reviewed"; `commit-push`'s own guards (archive-scoped pathspec, ff-only, never force-push, refusal on unpushed history) are what bound the damage.
diff --git a/CLAUDE.md b/CLAUDE.md
index c654472..90113b5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -19,7 +19,7 @@ This is a **Claude Code plugin marketplace** (monorepo) containing plugins that
 ## Current Plugins
 
 - **knowledge-system** (v1.9.x) — Knowledge management with three layers: Rules, Knowledge, Memory. Skills: `/init`, `/query`, `/curate`, `/reindex`, `/backfill-knowledge`, `/migrate`, `/statusline`
-- **work-system** (v1.10.x) — Task and worktree workflow. Skills: `/define`, `/kickoff`, `/adopt`, `/continue`, `/status`, `/close`, `/list`, `/statusline`
+- **work-system** (v1.11.x) — Task and worktree workflow (workers: Claude/codex/grok/kimi). Skills: `/define`, `/kickoff`, `/adopt`, `/continue`, `/status`, `/close`, `/list`, `/statusline`
 - **pr-flow** (v1.3.x) — PR review feedback loop. Skills: `/open`, `/cycle`, `/check`, `/fix`, `/rebase`, `/merge`
 - **swarm** (v0.7.x) — Local mixture-of-agents code review (external `codex`/`grok` CLIs — grok-4.5 — plus Claude lenses: 11 in 4 clusters). Every voice fans out per gated cluster; externals get file-read + web research under an OS secret-jail. P2: `/swarm:review` pipeline (scope→fan-out→merge→verify); P5: `--fix`/`--loop` apply the findings you agreed with. Skills: `/swarm:review`, `/swarm:agents`
 - **settings** (v0.1.x) — Per-plugin TOML config resolved over schema defaults; each plugin owns its `schema/settings.schema.json`. Skill: `/settings` (list/show/get/set/validate). Phase 1: config surface only.
diff --git a/README.md b/README.md
index be38db5..1df7b9f 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Lightweight, native knowledge management for Claude Code projects. Three layers
 
 ### Work System
 
-Generic task and worktree workflow system. Manage tasks as markdown files, work in isolated git worktrees, and track progress through the full lifecycle. `/kickoff` runs the repo's default worker agent (Claude, codex, or grok — a single committed per-project default), or, when none is set, shows a picker and offers to save your choice; override per run with flags like `--opus`/`--sol` or `--pick`. Inside a [herdr](plugins/work-system/README.md#herdr-integration) session it auto-opens a tab (named after the task, shortened for the sidebar and prefixed with the task's state glyph — `●` active, `◇` in review, `◆` approved, `✓` merged) with the worktree as cwd, starts the chosen worker, and — for a Claude worker — runs `/work-system:continue` for you (plugin-qualified, since a Claude Code built-in `/continue` shadows the bare skill); `/adopt` auto-opens the same tab once it has built the worktree from an existing branch; `/work-system:continue <task>` from the main session reopens that tab and resumes it if a stray `/exit` closed it; and `/close` tears the tab down again when the task is merged.
+Generic task and worktree workflow system. Manage tasks as markdown files, work in isolated git worktrees, and track progress through the full lifecycle. `/kickoff` runs the repo's default worker agent (Claude, codex, grok, or kimi — a single committed per-project default), or, when none is set, shows a picker and offers to save your choice; override per run with flags like `--opus`/`--sol` or `--pick`. Inside a [herdr](plugins/work-system/README.md#herdr-integration) session it auto-opens a tab (named after the task, shortened for the sidebar and prefixed with the task's state glyph — `●` active, `◇` in review, `◆` approved, `✓` merged) with the worktree as cwd, starts the chosen worker, and — for a Claude worker — runs `/work-system:continue` for you (plugin-qualified, since a Claude Code built-in `/continue` shadows the bare skill); `/adopt` auto-opens the same tab once it has built the worktree from an existing branch; `/work-system:continue <task>` from the main session reopens that tab and resumes it if a stray `/exit` closed it; and `/close` tears the tab down again when the task is merged.
 
 **Commands:** `/define`, `/kickoff`, `/adopt`, `/continue`, `/status`, `/close`, `/list`, `/statusline`
 
diff --git a/plugins/work-system/.claude-plugin/plugin.json b/plugins/work-system/.claude-plugin/plugin.json
index c3bf4b9..428cd2e 100644
--- a/plugins/work-system/.claude-plugin/plugin.json
+++ b/plugins/work-system/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "work-system",
-  "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, or grok), and track progress across the define/kickoff/continue/status/close lifecycle.",
-  "version": "1.10.0",
+  "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, run them in isolated git worktrees with a choice of worker agent (Claude, codex, grok, or kimi), and track progress across the define/kickoff/continue/status/close lifecycle.",
+  "version": "1.11.0",
   "author": {
     "name": "gering"
   },
diff --git a/plugins/work-system/README.md b/plugins/work-system/README.md
index 9d24dbe..5534680 100644
--- a/plugins/work-system/README.md
+++ b/plugins/work-system/README.md
@@ -28,7 +28,7 @@ Generic task and worktree workflow system for Claude Code. Manage tasks as markd
 | Command | Description |
 |---------|-------------|
 | `/define` | Create a new task (markdown file with Goal/Context/Requirements) |
-| `/kickoff` | Start a task in an isolated git worktree, with a choice of worker agent (Claude/codex/grok) |
+| `/kickoff` | Start a task in an isolated git worktree, with a choice of worker agent (Claude/codex/grok/kimi) |
 | `/adopt` | Adopt an existing branch into the work system |
 | `/continue` | Resume the current task (in a worktree); or `/continue <task>` from the main session reopens the task's herdr tab and resumes it |
 | `/status` | Check task status (PRs, branches, commits) |
@@ -109,6 +109,7 @@ shows a picker and offers to save your choice as the default:
 > /kickoff add-dark-mode --opus      # claude on opus
 > /kickoff add-dark-mode --sol       # codex on gpt-5.6-sol
 > /kickoff add-dark-mode --grok      # grok-4.5
+> /kickoff add-dark-mode --kimi      # kimi-code on k3-256k
 > /kickoff add-dark-mode --pick      # force the interactive picker
 ```
 
@@ -187,6 +188,7 @@ flag picks another:
 | `--fable` / `--opus` | claude on fable / opus |
 | `--codex` / `--sol` | codex on gpt-5.6-terra / gpt-5.6-sol |
 | `--grok` | grok-4.5 |
+| `--kimi` | kimi-code on k3-256k (launches in two phases — see below) |
 | `--agent <cli[:model]>` | any registry entry, e.g. `--agent claude:sonnet` or `--agent codex` |
 
 **The default is a single per-repo setting** — no global default, no shipped
@@ -197,17 +199,36 @@ in a repo with no default yet. Everything is registry-driven — no ranking, no
 call; the default is a simple, explicit choice (the hook where future task-aware
 routing can plug in).
 
-**Non-Claude workers degrade honestly.** codex/grok have no work-system skills,
-so a launched worker gets a bootstrap prompt (read `TASK.md`, commit, open a PR)
-instead of `/continue`. Everything git/PR-derived (`/status`, `/list`, the
+**Non-Claude workers degrade honestly.** codex/grok/kimi have no work-system
+skills, so a launched worker gets a bootstrap prompt (read `TASK.md`, commit, open
+a PR) instead of `/continue`. Everything git/PR-derived (`/status`, `/list`, the
 `[ws]` statusline, `/close`'s tab teardown) works for any worker; only
 claude-session concepts differ. `/continue`'s reopen **always sends `claude -c`**
 — the work-system doesn't persist which worker a task used (per-task agent memory
 is a later idea), so it can't dispatch per CLI. That resumes a claude worker; for
-a codex/grok task it's a *new* Claude session, so you resume the real worker
-yourself in the tab (`codex resume --last` / `grok -c`) — `/continue` surfaces
-this caveat inline. Since both CLIs read `AGENTS.md`, dropping a short `AGENTS.md`
-note into the worktree is an optional way to give them standing task guidance.
+a codex/grok/kimi task it's a *new* Claude session, so you resume the real worker
+yourself in the tab (`codex resume --last` / `grok -c` / `kimi -c`) — `/continue`
+surfaces this caveat inline. Since codex and grok read `AGENTS.md`, dropping a
+short `AGENTS.md` note into the worktree is an optional way to give them standing
+task guidance.
+
+**kimi launches in two phases.** It has no positional launch prompt, and its
+one-shot `-p` flag can't be combined with the autonomous `--auto`/`-y` modes — so
+the worker is `sh -c 'kimi -m "$1" -p "$2" || <report+wait>; exec kimi -c --auto' …`:
+the `-p` seed
+works the task through once (it runs tools unattended), then `exec` hands over to
+the interactive autonomous session, which inherits the seed's full history. So
+unlike the other workers, a kimi tab has already made progress by the time you
+switch to it.
+
+**What that costs you, stated plainly.** Both kimi phases run *without
+tool-approval prompts* — the seed by construction (`-p` cannot be combined with
+an approval mode) and phase 2 by choice (`--auto`). claude/codex/grok all ask
+before acting; kimi does not. So whatever `TASK.md` says is carried out in a
+worktree that holds your git credentials, before you have looked at the tab. For
+`/kickoff` that file is yours. For `/adopt` it is summarized from **someone
+else's** commits and diff — read it before launching a kimi worker on it.
+`/kickoff` announces the unattended start whenever the resolved worker is kimi.
 
 ## herdr integration
 
@@ -225,7 +246,7 @@ Inside herdr, `/kickoff` doesn't just create the worktree and print manual
 instructions — it opens a new herdr **tab** in the *same* workspace, with the
 worktree as its cwd, and starts the task there for you. `/adopt` does exactly the
 same once it has created the worktree from an existing branch — same helper, same
-tab, same worker selection (`--opus`/`--sol`/`--grok`/`--pick`, or the repo default);
+tab, same worker selection (`--opus`/`--sol`/`--grok`/`--kimi`/`--pick`, or the repo default);
 its tab label comes from the *resolved* task name, so it's sensible even when `/adopt`
 keeps the original branch name rather than renaming it to `task/<name>`:
 
@@ -238,8 +259,10 @@ keeps the original branch name rather than renaming it to `task/<name>`:
 - The chosen worker is launched directly as argv (`herdr agent start … --
   <resolved worker command>`), so the real CLI process is what herdr's agent-state
   detection sees. A claude worker gets `claude --model <m> -n "<label>" "/work-system:continue"`
-  and loads the task context automatically; a codex/grok worker gets a bootstrap
+  and loads the task context automatically; a codex/grok/kimi worker gets a bootstrap
   prompt (read `TASK.md`, drive the task to a PR) since they have no work-system skills.
+  A kimi worker's pane roots at a short `sh -c` wrapper that `exec`s into kimi, so
+  what herdr ends up watching is the real kimi process.
 - The new tab opens in the background (`--no-focus`), so the session you launched
   from (`/kickoff` or `/adopt`, in the main repo) stays in front; switch to the tab
   when you're ready to work there.
diff --git a/plugins/work-system/scripts/agent-registry.sh b/plugins/work-system/scripts/agent-registry.sh
index 87447f5..b9b94eb 100755
--- a/plugins/work-system/scripts/agent-registry.sh
+++ b/plugins/work-system/scripts/agent-registry.sh
@@ -12,7 +12,7 @@
 #   resolve <selector> [--session <name>]
 #                                 Map a selector to launch argv + metadata.
 #                                 Selectors: a shorthand flag (--fable, --opus,
-#                                 --codex, --sol, --grok), a
+#                                 --codex, --sol, --grok, --kimi), a
 #                                 canonical name (claude:opus), a bare CLI
 #                                 (codex -> that CLI's default model), or
 #                                 cli:model (the --agent escape hatch).
@@ -31,11 +31,27 @@
 #              the work-system continue skill resumes TASK.md deterministically)
 #   codex   -> codex -m <model> <bootstrap-prompt>
 #   grok    -> grok  -m <model> <bootstrap-prompt>
-#   The bootstrap prompt (codex/grok have no work-system skills) tells the agent
-#   to read TASK.md and drive the task to a PR. `supports=` metadata records
+#   kimi    -> sh -c 'kimi -m "$1" -p "$2"; exec kimi -c --auto' \
+#                    kimi-worker <model> <bootstrap-prompt>          (seed+continue)
+#   The bootstrap prompt (codex/grok/kimi have no work-system skills) tells the
+#   agent to read TASK.md and drive the task to a PR. `supports=` metadata records
 #   which lifecycle hooks each agent honors, so /close and /continue can degrade
 #   for non-claude workers instead of faking claude-only behavior.
 #
+#   Why kimi needs the two-phase seed+continue shape (all probed live, 0.31.1):
+#   kimi has NO positional launch prompt (`kimi "text"` -> "unknown command"), no
+#   initial-prompt env var, and piped stdin only prefills the input box without
+#   submitting (and would steal the TUI's tty anyway). `-p` is the only way in,
+#   but it is mutually exclusive with BOTH `--auto` and `-y` and exits after one
+#   answer — so `-p` alone cannot be a worker. It does run tools unattended, and
+#   `kimi -c` inherits its full session history, so: phase 1 seeds+works the task
+#   one-shot, phase 2 `exec`s into the interactive autonomous session with that
+#   history. The `exec` matters — it re-roots the herdr pane at kimi, and `;` (not
+#   `&&`) keeps phase 2 alive if the seed fails, leaving a usable tab instead of a
+#   dead one. Values travel as "$1"/"$2" positionals, never interpolated into the
+#   script text: `-p` swallows the next token as its value, so an argv built by
+#   concatenation is one reordering away from silently eating a flag.
+#
 # State & config (override for tests / relocation):
 #   WORK_SYSTEM_AGENT_PROJECT_STATE  the repo's default-agent file
 #                                    default: <repo-root>/.claude/work-system-agent
@@ -67,11 +83,30 @@ if [ -z "$PROJECT_STATE" ]; then
   [ -n "$_repo_root" ] && PROJECT_STATE="$_repo_root/.claude/work-system-agent"
 fi
 GROK_AUTH_FILE="${GROK_AUTH_FILE:-$HOME/.grok/auth.json}"
+# kimi's OAuth tokens live in credentials/, NOT in the same-named oauth/ dir —
+# `~/.kimi-code/oauth/kimi-code` exists but stays 0 bytes even when logged in, so
+# probing that path would report every authenticated install as logged out.
+KIMI_CREDENTIALS_FILE="${KIMI_CREDENTIALS_FILE:-$HOME/.kimi-code/credentials/kimi-code.json}"
 
-# The bootstrap prompt for CLIs without work-system skills (codex, grok). One
+# The bootstrap prompt for CLIs without work-system skills (codex, grok, kimi). One
 # argv word; the launch helper passes it verbatim.
 BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on the current branch as you go, and open a PR when the work is complete.'
 
+# kimi's two-phase launch script (see the header). Defined once here so the shape
+# has exactly one home; emit_argv passes it as the `sh -c` word.
+#
+# The seed's failure is made LOUD on purpose. `;` would run phase 2 regardless and
+# the TUI's first repaint scrolls the error off-screen — leaving a tab that looks
+# like a healthy worker but never read TASK.md. `&&` is not the fix either: it
+# kills the pane, and the task's whole point is that the tab survives. So: report,
+# wait for an explicit keypress, then hand over to an (empty) session the user now
+# knows is empty. Verified: a failed seed in a fresh worktree yields a NEW empty
+# session, never a foreign one — `kimi -c` is scoped to the working directory.
+# Kept ASCII-only and free of backslash escapes so `printf %q` renders it as a
+# plain single-quoted word in `argv_shell=` — a `$'…'` form would be bash/zsh-only
+# and near-unreadable in the copy-paste block.
+KIMI_LAUNCH_SCRIPT='kimi -m "$1" -p "$2" || { echo; echo "[work-system] kimi seed FAILED (see the error above): TASK.md was not read, nothing was started."; echo "Press Enter to open an empty kimi session in this worktree."; read -r _; }; exec kimi -c --auto'
+
 # ---------- registry ----------
 # `flag|cli|model|supports`. flag `-` = no shorthand (name/--agent only). The
 # FIRST entry of each CLI is that CLI's default model (for a bare `--agent codex`).
@@ -80,9 +115,9 @@ BOOTSTRAP_PROMPT='Read TASK.md in this worktree and continue the task. Commit on
 #   continue   -> `/continue`-reopen + `claude -c` session resume work
 #   close-exit -> /close may inject `/exit` for a clean self-teardown
 #   statusline -> the `[ws]` statusline segment tracks its session
-# codex/grok get commit,pr only — they drive git + a PR but have none of the
+# codex/grok/kimi get commit,pr only — they drive git + a PR but have none of the
 # claude-session lifecycle hooks. RESERVED / not yet consumed: the skills
-# currently hardcode the claude-vs-codex/grok distinction in prose; this field is
+# currently hardcode the claude-vs-non-claude distinction in prose; this field is
 # the seed for the manager/worker-orchestration design to read per-agent
 # capabilities from one place. Keep it in sync when that lands.
 REGISTRY='--fable|claude|fable|continue,close-exit,statusline,commit,pr
@@ -90,7 +125,8 @@ REGISTRY='--fable|claude|fable|continue,close-exit,statusline,commit,pr
 -|claude|sonnet|continue,close-exit,statusline,commit,pr
 --codex|codex|gpt-5.6-terra|commit,pr
 --sol|codex|gpt-5.6-sol|commit,pr
---grok|grok|grok-4.5|commit,pr'
+--grok|grok|grok-4.5|commit,pr
+--kimi|kimi|kimi-code/k3-256k|commit,pr'
 
 usage() {
   # Usage = header comment from line 2 up to (not including) the registry
@@ -157,7 +193,20 @@ row_for_selector() {
 #           rejects an unlisted `-m` id at launch ("unknown model id"), so a
 #           per-CLI auth check alone would mislabel a model the CLI no longer
 #           offers (grok drops/renames models between releases) as available.
-#           This is the one CLI with a usable model-list command.
+#   kimi:   install + auth file + the model must appear in `kimi provider list
+#           --json`. Model-aware for the same reason as grok, and the failure is
+#           even sharper: an unconfigured `-m` id aborts at startup
+#           ("Model ... is not configured in config.toml"), so a bad model would
+#           give the user a worker tab that dies on sight. The model id must be
+#           the QUALIFIED alias (`kimi-code/k3-256k`) — the bare model name is
+#           rejected the same way. `kimi doctor` is NOT an auth check (it only
+#           validates config file syntax), hence the credentials-file probe.
+#           The listing is local config (~0.7s, no network), but it is bounded
+#           anyway: a catalog refresh on start can make it reach out. The match
+#           requires the alias in KEY position (`"<model>":`) — the real document
+#           is flat-qualified (`"models": {"kimi-code/k3-256k": {…}}`, verified
+#           live), so a bare substring would also fire on the alias appearing as
+#           a VALUE (a `default_model`/metadata field) while `models` is empty.
 
 # run_bounded <seconds> <cmd...> — run cmd with a hard time bound so an external
 # probe can never hang `list`/the picker. Prints cmd's stdout; returns cmd's exit
@@ -212,6 +261,14 @@ grok_models_raw() {
   run_bounded 10 grok models 2>/dev/null
 }
 
+# Same contract as grok_models_raw, for kimi: RAW `kimi provider list --json` on
+# stdout, exit code = fetch status. entry_status substring-matches the qualified
+# model alias against the raw JSON rather than parsing it — no jq/python
+# dependency, and a reshaped config document can't yield a wrong token.
+kimi_models_raw() {
+  run_bounded 10 kimi provider list --json 2>/dev/null
+}
+
 entry_status() {
   local cli="$1" model="$2" avail=no note=""
   case "$cli" in
@@ -252,6 +309,28 @@ entry_status() {
         else note="model not offered by this grok CLI (see: grok models)"; fi
       fi
       ;;
+    kimi)
+      if ! command -v kimi >/dev/null 2>&1; then note="not installed"
+      elif [ ! -s "$KIMI_CREDENTIALS_FILE" ]; then note="run: kimi login"
+      else
+        local _kraw krc=0
+        _kraw="$(kimi_models_raw)" || krc=$?   # exit code = fetch status
+        if [ "$krc" -ne 0 ]; then
+          # unreachable/timed out — inconclusive, trust auth (mirrors grok).
+          avail=yes; note="kimi provider list unreachable — availability assumed"
+        elif ! grep -qF -- '"models"' <<<"$_kraw"; then
+          # Empty output fails this grep too, so it lands here — no separate `-z`
+          # arm (unlike grok's, whose empty case carries its own note).
+          # A document without the `models` section we key off. Unlike
+          # grok's plain-text listing, a JSON reply is only self-describing while
+          # the schema holds: `{"models": {}}` IS a real "no models" answer, but a
+          # renamed/moved section is drift and must not read as one. Gate on the
+          # section's presence, so only the former reaches the match below.
+          avail=yes; note="kimi provider list unrecognized — availability assumed"
+        elif grep -qF -- "\"$model\":" <<<"$_kraw"; then avail=yes
+        else note="model not offered by this kimi CLI (see: kimi provider list)"; fi
+      fi
+      ;;
     *) note="unknown cli" ;;
   esac
   printf '%s\t%s\n' "$avail" "$note"
@@ -259,24 +338,55 @@ entry_status() {
 
 # ---------- subcommands ----------
 
+# POSIX single-quote one word for `argv_shell=`. Not `printf %q`: bash 3.2
+# renders that as per-character backslash escapes (and `$'…'` for anything
+# non-ASCII) — correct, but the result is a wall of backslashes that a user
+# cannot read before pasting it, and `$'…'` is bash/zsh-only. Words made only of
+# safe characters are passed through bare; everything else is wrapped, with any
+# embedded quote closed-escaped-reopened ('\'') the way every POSIX shell parses.
+shell_quote() {
+  case "$1" in
+    ''|*[!A-Za-z0-9_@%+=:,./-]*)
+      printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")" ;;
+    *) printf '%s' "$1" ;;
+  esac
+}
+
 emit_argv() {
-  # Print `argv=<word>` lines for a resolved entry. $1=cli $2=model $3=session.
+  # Print `argv=<word>` lines for a resolved entry, then ONE `argv_shell=` line
+  # with the same words shell-quoted. $1=cli $2=model $3=session.
   local cli="$1" model="$2" session="$3"
+  local words=()
   case "$cli" in
     claude)
-      printf 'argv=%s\n' claude --model "$model"
-      [ -n "$session" ] && printf 'argv=%s\n' -n "$session"
+      words=(claude --model "$model")
+      [ -n "$session" ] && words+=(-n "$session")
       # Plugin-qualified: a CC built-in/alias `/continue` shadows the skill, so
       # the bare form would run CC's own resume, not the work-system flow.
-      printf 'argv=%s\n' /work-system:continue
+      words+=(/work-system:continue)
       ;;
-    codex)
-      printf 'argv=%s\n' codex -m "$model" "$BOOTSTRAP_PROMPT"
-      ;;
-    grok)
-      printf 'argv=%s\n' grok -m "$model" "$BOOTSTRAP_PROMPT"
+    codex) words=(codex -m "$model" "$BOOTSTRAP_PROMPT") ;;
+    grok)  words=(grok  -m "$model" "$BOOTSTRAP_PROMPT") ;;
+    kimi)
+      # Two-phase seed+continue (see the launch-shape note in the header). The
+      # model and the prompt are passed as "$1"/"$2" positionals — NOT spliced
+      # into the script text — so no amount of prompt content can reorder the
+      # flags or be absorbed by `-p`.
+      words=(sh -c "$KIMI_LAUNCH_SCRIPT" kimi-worker "$model" "$BOOTSTRAP_PROMPT")
       ;;
   esac
+  # Guard the expansion: under `set -u` a bash 3.2 `"${words[@]}"` on an EMPTY
+  # array is an unbound-variable error, which an unknown cli would hit.
+  [ "${#words[@]}" -gt 0 ] || return 0
+  printf 'argv=%s\n' "${words[@]}"
+  # A ready-to-paste command line, quoted by printf %q rather than by whoever
+  # renders the manual-launch block. That rendering used to be a prose rule, and
+  # for kimi a mis-quote is not cosmetic: its argv carries `;` and `exec`, so an
+  # unquoted paste would replace the USER'S OWN interactive shell with an
+  # unattended agent. Skills print this verbatim instead of re-deriving it.
+  local shell_cmd="" w
+  for w in "${words[@]}"; do shell_cmd="$shell_cmd$(shell_quote "$w") "; done
+  printf 'argv_shell=%s\n' "${shell_cmd% }"
 }
 
 subcmd_resolve() {
@@ -303,7 +413,9 @@ subcmd_resolve() {
   local record
   record="$(row_for_selector "$selector")" || {
     echo "Unknown agent selector: $selector" >&2
-    echo "Try: --fable --opus --codex --sol --grok, a name (claude:opus), or a cli (codex)" >&2
+    # Derive the flag list from REGISTRY rather than restating it — a new entry
+    # must not need a second edit here to appear in the hint.
+    echo "Try: $(registry_rows | cut -d'|' -f1 | grep -v '^-$' | tr '\n' ' ')— a name (claude:opus), or a cli (codex)" >&2
     exit 2
   }
   local flag cli model supports
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index e92d16b..c76fa04 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -11,7 +11,7 @@
 #                         the kickoff knowledge entry) — a fresh interactive shell
 #                         can eat the leading keystrokes of a typed command.
 #                         The worker argv is resolved from an agent SELECTOR via
-#                         agent-registry.sh (claude/codex/grok × model); with no
+#                         agent-registry.sh (claude/codex/grok/kimi × model); with no
 #                         selector it stays the legacy `claude … /work-system:continue`. The
 #                         registry owns every per-CLI launch detail, so this script
 #                         is CLI-agnostic — it just execs the resolved argv.
@@ -38,7 +38,7 @@
 #     worktree       absolute path to the worktree (becomes the new pane's cwd)
 #     workspace-id   herdr workspace to open the tab in (e.g. $HERDR_WORKSPACE_ID)
 #     agent-selector (launch only) agent-registry selector: a shorthand flag
-#                    (--fable/--opus/--codex/--sol/--grok), a name
+#                    (--fable/--opus/--codex/--sol/--grok/--kimi), a name
 #                    (claude:opus), or a bare cli. Empty → legacy claude default.
 #     session-name   (launch only) `claude -n` name; defaults to <label>
 #
@@ -245,7 +245,7 @@ case "$mode" in
     # per-CLI launch shape; herdr-launch stays argv-exec (no shell-typing race)
     # and CLI-agnostic — it just execs whatever argv the registry resolves.
     #   no selector → legacy path: claude on the user's default model.
-    #   a selector  → resolve it (claude/codex/grok, per model). exit 2 on an
+    #   a selector  → resolve it (claude/codex/grok/kimi, per model). exit 2 on an
     #                 unknown selector; exit 3 (with note) if the CLI is not
     #                 available, so the caller shows a clear "run: … login".
     worker_argv=()
diff --git a/plugins/work-system/scripts/test_agent_registry.py b/plugins/work-system/scripts/test_agent_registry.py
index 9a49d65..a5529c3 100644
--- a/plugins/work-system/scripts/test_agent_registry.py
+++ b/plugins/work-system/scripts/test_agent_registry.py
@@ -3,13 +3,17 @@
 or via scripts/check-structure.py's "plugin tests" check.
 
 Guards the registry's contract: alias/name/cli selector resolution, the per-CLI
-launch argv shape (claude `/work-system:continue` vs codex/grok bootstrap prompt), the
-availability probe (codex login status + grok auth file + grok model-list), the
-exit-code map (2 unknown selector, 3 resolved-but-unavailable), and the
-project-default state (set/get, bogus rejection, no-git-repo error).
-
-Availability is made deterministic with fake `codex`/`grok`/`claude` stubs on a
-prepended PATH, so the test does not depend on what is really installed/authed.
+launch argv shape (claude `/work-system:continue` vs the codex/grok/kimi bootstrap
+prompt, incl. kimi's two-phase seed+continue argv and its argument-order
+regression), the availability probe (codex login status + grok/kimi auth file +
+grok/kimi model-list), the exit-code map (2 unknown selector, 3
+resolved-but-unavailable), and the project-default state (set/get, bogus
+rejection, no-git-repo error).
+
+Availability is made deterministic with fake `codex`/`grok`/`kimi`/`claude` stubs
+on a prepended PATH, so the test does not depend on what is really
+installed/authed. The kimi stub also logs every invocation's argv, so the
+resolved launch argv can be executed for real and each phase asserted.
 """
 import json
 import os
@@ -33,7 +37,9 @@ class Env:
     """A throwaway HOME + fake-bin sandbox controlling CLI availability."""
 
     def __init__(self, codex_authed=True, grok_authed=True,
-                 grok_models=("grok-4.5",), grok_models_ok=True):
+                 grok_models=("grok-4.5",), grok_models_ok=True,
+                 kimi_authed=True, kimi_models=("kimi-code/k3-256k",),
+                 kimi_models_ok=True, kimi_schema_ok=True):
         self.tmp = tempfile.TemporaryDirectory()
         root = Path(self.tmp.name)
         self.home = root / "home"
@@ -64,18 +70,43 @@ def __init__(self, codex_authed=True, grok_authed=True,
         )
         # claude stub: only ever hit by `command -v`.
         (bindir / "claude").write_text("#!/bin/sh\nexit 0\n")
+        # kimi stub: `provider list --json` drives the model-level probe (raw
+        # JSON, substring-matched). Every invocation also appends its full argv
+        # (one tab-joined line per call) to KIMI_ARGLOG, so a test can execute
+        # the resolved launch argv for real and assert what each phase received.
+        self.kimi_arglog = root / "kimi_args.log"
+        # kimi_schema_ok=False simulates format drift: a valid but differently
+        # shaped document (no `models` section) — distinct from a well-formed
+        # listing that genuinely offers nothing.
+        kimi_section = "models" if kimi_schema_ok else "aliases"
+        kimi_model_json = ",".join('\\"%s\\": {}' % m for m in kimi_models)
+        (bindir / "kimi").write_text(
+            "#!/bin/sh\n"
+            '[ -n "$KIMI_ARGLOG" ] && { printf \'%%s\\t\' "$@" >> "$KIMI_ARGLOG"; '
+            'printf \'\\n\' >> "$KIMI_ARGLOG"; }\n'
+            'if [ "$1" = "provider" ] && [ "$2" = "list" ]; then\n'
+            '  echo "{\\"%s\\": {%s}}"\n'
+            "  exit %d\n"
+            "fi\n"
+            "exit 0\n" % (kimi_section, kimi_model_json, 0 if kimi_models_ok else 1)
+        )
         for f in bindir.iterdir():
             f.chmod(0o755)
         # grok auth file toggles grok readiness.
         self.grok_auth = root / "grok_auth.json"
         if grok_authed:
             self.grok_auth.write_text("{}\n")
+        # kimi's real tokens live in credentials/, not the same-named oauth/ dir.
+        self.kimi_creds = root / "kimi_credentials.json"
+        if kimi_authed:
+            self.kimi_creds.write_text("{}\n")
         self.project_state = root / "repo" / ".claude" / "work-system-agent"
 
         self.env = dict(os.environ)
         self.env["PATH"] = f"{bindir}:{self.env['PATH']}"
         self.env["HOME"] = str(self.home)
         self.env["GROK_AUTH_FILE"] = str(self.grok_auth)
+        self.env["KIMI_CREDENTIALS_FILE"] = str(self.kimi_creds)
         self.env["WORK_SYSTEM_AGENT_PROJECT_STATE"] = str(self.project_state)
 
     def run(self, *args, project_state=True):
@@ -89,6 +120,17 @@ def run(self, *args, project_state=True):
             env=env, cwd=str(self.home), capture_output=True, text=True,
         )
 
+    def run_argv(self, argv):
+        """Execute a resolved launch argv against the stubs; return the per-call
+        argv lines the kimi stub recorded."""
+        env = dict(self.env)
+        env["KIMI_ARGLOG"] = str(self.kimi_arglog)
+        self.kimi_arglog.write_text("")
+        subprocess.run(argv, env=env, cwd=str(self.home), stdin=subprocess.DEVNULL,
+                       capture_output=True, text=True, timeout=30)
+        return [line.split("\t")[:-1]
+                for line in self.kimi_arglog.read_text().splitlines()]
+
     def close(self):
         self.tmp.cleanup()
 
@@ -134,6 +176,89 @@ def kv(out):
 check("--grok -> grok:grok-4.5", r.get("name") == "grok:grok-4.5")
 check("grok argv shape", r["argv"][:3] == ["grok", "-m", "grok-4.5"])
 
+# --- kimi: the two-phase seed+continue launch argv ------------------------- #
+# kimi has no positional launch prompt and `-p` cannot be combined with --auto/-y,
+# so a worker is `-p` (seed, runs tools unattended) then `exec kimi -c --auto`
+# (interactive + autonomous, inheriting the seed's session history).
+KIMI_SCRIPT = (
+    'kimi -m "$1" -p "$2" || { echo; '
+    'echo "[work-system] kimi seed FAILED (see the error above): '
+    'TASK.md was not read, nothing was started."; '
+    'echo "Press Enter to open an empty kimi session in this worktree."; '
+    'read -r _; }; exec kimi -c --auto'
+)
+
+r = kv(e.run("resolve", "--kimi").stdout)
+check("--kimi -> kimi:kimi-code/k3-256k", r.get("name") == "kimi:kimi-code/k3-256k")
+check("kimi model is the QUALIFIED alias (bare name aborts at startup)",
+      r.get("model") == "kimi-code/k3-256k")
+check("kimi supports commit,pr only", r.get("supports") == "commit,pr")
+# Exact word list — the whole point of this test.
+check("kimi argv shape",
+      r["argv"][:5] == ["sh", "-c", KIMI_SCRIPT, "kimi-worker", "kimi-code/k3-256k"])
+check("kimi argv is exactly 6 words", len(r["argv"]) == 6)
+check("kimi bootstrap is the last word and mentions TASK.md",
+      "TASK.md" in r["argv"][5])
+
+# Argument-order regression: `-p <value>` consumes the NEXT token, so an argv
+# built by concatenation can silently swallow a flag (`kimi -p --auto "…"` ->
+# --auto becomes the prompt and the prompt becomes an unknown subcommand). Two
+# structural guarantees prevent that, and both are asserted:
+#   1. the model and the prompt are passed as positionals, never spliced into
+#      the script text (so their content cannot reorder anything), and
+#   2. --auto lives in a different command than -p (after the `;`), so it can
+#      never land in -p's value position.
+script = r["argv"][2]
+check("model is not spliced into the script text", "kimi-code/k3-256k" not in script)
+# Compare against the actual prompt word, not a substring of it: the script text
+# legitimately mentions TASK.md in its seed-failure message.
+check("prompt is not spliced into the script text", r["argv"][5] not in script)
+check("-p takes the positional as its value", '-p "$2"' in script)
+check("--auto is not in the same command as -p",
+      "--auto" not in script.split("||", 1)[0])
+check("no bare -p/--prompt argv word (it stays bound inside the script)",
+      "-p" not in r["argv"] and "--prompt" not in r["argv"])
+# A failed seed must neither kill the pane (`&&`) nor slip past unseen (`;`):
+# it reports, waits for a keypress, then still hands over to phase 2.
+check("seed failure is announced, not silent", "seed FAILED" in script)
+check("seed failure waits for acknowledgement", "read -r _" in script)
+check("phase 2 still runs after a failed seed (tab survives)",
+      script.rstrip().endswith("exec kimi -c --auto")
+      and "&&" not in script.split("exec", 1)[0].replace("||", ""))
+
+# Execute the resolved argv for real against the stub and assert what each phase
+# actually received — string checks alone can't prove the shell binds the values
+# the way we think it does.
+calls = e.run_argv(r["argv"])
+check("kimi launch runs exactly two phases", len(calls) == 2)
+if len(calls) == 2:
+    seed, cont = calls
+    check("phase 1 is the -p seed with the model and prompt intact",
+          seed[:3] == ["-m", "kimi-code/k3-256k", "-p"] and "TASK.md" in seed[3])
+    check("phase 1 got exactly 4 args (nothing swallowed, nothing extra)",
+          len(seed) == 4)
+    check("phase 1 never carries --auto/-y (mutually exclusive with -p)",
+          "--auto" not in seed and "-y" not in seed)
+    check("phase 2 is the interactive autonomous continue", cont == ["-c", "--auto"])
+
+# A FAILING seed must still reach phase 2 — the tab has to survive. Runs the real
+# argv against a stub whose non-`provider` calls exit 1 (the first stub always
+# exits 0, so this path was previously untested).
+e_fail = Env()
+(Path(e_fail.env["PATH"].split(":")[0]) / "kimi").write_text(
+    "#!/bin/sh\n"
+    '[ -n "$KIMI_ARGLOG" ] && { printf \'%s\\t\' "$@" >> "$KIMI_ARGLOG"; '
+    'printf \'\\n\' >> "$KIMI_ARGLOG"; }\n'
+    'if [ "$1" = "provider" ]; then echo \'{"models": {"kimi-code/k3-256k": {}}}\'; exit 0; fi\n'
+    "exit 1\n"
+)
+(Path(e_fail.env["PATH"].split(":")[0]) / "kimi").chmod(0o755)
+fail_calls = e_fail.run_argv(kv(e_fail.run("resolve", "--kimi").stdout)["argv"])
+check("a failed seed still reaches phase 2", len(fail_calls) == 2)
+if len(fail_calls) == 2:
+    check("phase 2 after a failed seed is still -c --auto", fail_calls[1] == ["-c", "--auto"])
+e_fail.close()
+
 # canonical name and bare-cli-default selectors
 check("name selector claude:sonnet",
       kv(e.run("resolve", "claude:sonnet").stdout).get("model") == "sonnet")
@@ -205,6 +330,58 @@ def kv(out):
 check("empty note is soft", "assumed" in by["grok:grok-4.5"]["note"])
 e.close()
 
+# --- kimi model-level availability (same contract as grok) ----------------- #
+# Model-aware for a sharper reason than grok's: an unconfigured `-m` id aborts
+# kimi at startup, so a stale model would hand the user a tab that dies on sight.
+e = Env(kimi_models=("kimi-code/k3-256k",))
+by = {r["name"]: r for r in json.loads(e.run("list", "--json").stdout)}
+check("kimi model listed -> available", by["kimi:kimi-code/k3-256k"]["available"] is True)
+check("resolve --kimi available -> exit 0", e.run("resolve", "--kimi").returncode == 0)
+e.close()
+
+# authed, but the registry's model is not in the provider listing -> refuse now.
+e = Env(kimi_models=("kimi-code/k9-imaginary",))
+by = {r["name"]: r for r in json.loads(e.run("list", "--json").stdout)}
+check("kimi model not listed -> unavailable", by["kimi:kimi-code/k3-256k"]["available"] is False)
+check("kimi unlisted note points at the listing",
+      "kimi provider list" in by["kimi:kimi-code/k3-256k"]["note"])
+check("resolve --kimi unavailable -> exit 3", e.run("resolve", "--kimi").returncode == 3)
+e.close()
+
+# no credentials file -> logged out. (Probing ~/.kimi-code/oauth/ instead would
+# report every authenticated install as logged out: that file stays 0 bytes.)
+e = Env(kimi_authed=False)
+by = {r["name"]: r for r in json.loads(e.run("list", "--json").stdout)}
+check("kimi unauthed -> unavailable", by["kimi:kimi-code/k3-256k"]["available"] is False)
+check("kimi note is login hint", "kimi login" in by["kimi:kimi-code/k3-256k"]["note"])
+e.close()
+
+# listing unreachable / empty-but-ok -> inconclusive, trust auth (mirrors grok).
+e = Env(kimi_models=(), kimi_models_ok=False)
+by = {r["name"]: r for r in json.loads(e.run("list", "--json").stdout)}
+check("kimi listing unreachable -> assumed available",
+      by["kimi:kimi-code/k3-256k"]["available"] is True)
+check("kimi unreachable note is soft", "unreachable" in by["kimi:kimi-code/k3-256k"]["note"])
+e.close()
+
+# A well-formed listing that offers NO models is a real answer, not drift ->
+# unavailable (the launch would abort at startup anyway).
+e = Env(kimi_models=(), kimi_models_ok=True)
+by = {r["name"]: r for r in json.loads(e.run("list", "--json").stdout)}
+check("kimi listing with zero models -> unavailable",
+      by["kimi:kimi-code/k3-256k"]["available"] is False)
+e.close()
+
+# Schema drift (the `models` section renamed/moved) is NOT a real answer: the
+# match would fail for a reason that says nothing about the model, so trust auth
+# rather than silently disabling the whole kimi backend on a format change.
+e = Env(kimi_schema_ok=False)
+by = {r["name"]: r for r in json.loads(e.run("list", "--json").stdout)}
+check("kimi schema drift -> assumed available",
+      by["kimi:kimi-code/k3-256k"]["available"] is True)
+check("kimi drift note is soft", "assumed" in by["kimi:kimi-code/k3-256k"]["note"])
+e.close()
+
 # --- project default (the only persisted state) ---------------------------- #
 e = Env()
 # nothing set -> empty (no-flag /kickoff then shows the picker)
diff --git a/plugins/work-system/skills/adopt/SKILL.md b/plugins/work-system/skills/adopt/SKILL.md
index f6dca15..e28be2d 100644
--- a/plugins/work-system/skills/adopt/SKILL.md
+++ b/plugins/work-system/skills/adopt/SKILL.md
@@ -15,7 +15,7 @@ user_invocable: true
 
 - `$ARGUMENTS` — `<branch> [agent-selector]`: optional branch name to adopt, plus an
   optional worker-agent selector (same set as `/kickoff`: `--fable`, `--opus`, `--sol`,
-  `--grok`, `--codex`, `--agent <cli[:model]>`, `--pick`). The selector chooses the
+  `--grok`, `--codex`, `--kimi`, `--agent <cli[:model]>`, `--pick`). The selector chooses the
   worker the herdr auto-launch (step 13) starts; omit it to use the repo default. The
   **branch is the token that does not start with `-`**; step 2 separates the two.
 
@@ -133,8 +133,8 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
     With `REG="${CLAUDE_PLUGIN_ROOT}/scripts/agent-registry.sh"`, only the
     token→`SELECTOR` mapping is restated, because it must match step 2's split (the
     selector may precede or follow the branch — never assume it comes "after" it):
-    - a shorthand flag (`--fable`/`--opus`/`--sol`/`--grok`/`--codex`) → `SELECTOR` is
-      that flag verbatim;
+    - a shorthand flag (`--fable`/`--opus`/`--sol`/`--grok`/`--codex`/`--kimi`) →
+      `SELECTOR` is that flag verbatim;
     - `--agent <cli[:model]>` → `SELECTOR` is the **`cli[:model]` value**, not the
       `--agent` token (the registry resolves the bare value; the flag verbatim fails as
       an unknown selector — exit 2);
@@ -144,6 +144,12 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
     The helper (step 13) resolves and validates `SELECTOR`, so don't resolve
     models/availability yourself.
 
+    **If the resolved worker is `kimi:…`, warn before launching** (announce, don't
+    block): kimi runs unattended (no tool-approval prompts), and an adopted TASK.md
+    is summarized from *another branch's* commits — so it is the one path where an
+    unattended worker acts on content the user did not write. Suggest reading the
+    generated task file first.
+
 13. **Launch the worktree session** — automate inside herdr, otherwise show the
     manual block. Inside herdr this replaces the old "print manual instructions" final
     step: `/adopt` now opens the task's tab for you, exactly like `/kickoff`.
@@ -194,8 +200,10 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
     **b) Outside herdr (or on any fallback) — manual instructions.** Resolve the
     selector to the exact launch command (registry-driven — do not hand-write it per
     CLI): `bash "$REG" resolve "$SELECTOR" --session "<task-name>"`. Take the `argv=`
-    lines in order and **shell-quote each word** (the codex/grok bootstrap prompt is one
-    `argv=` word containing spaces; space-joining raw would split it). Display this block
+    `argv_shell=` line **verbatim** — the registry already shell-quoted it, and
+    re-deriving the quoting is exactly the hazard: one of kimi's words is a shell
+    script carrying `;` and `exec`, which a mis-quoted render would run in the
+    user's own interactive shell. Display this block
     — do **not** execute the `cd`:
     ```
     Branch adopted into work system!
@@ -210,13 +218,14 @@ The Bash tool persists CWD between calls — a bare `cd .claude/worktrees/<task>
        session — this session stays in the main repo) and run:
 
          cd .claude/worktrees/<task-name>
-         <the argv= words, each shell-quoted>
+         <the argv_shell= line, verbatim>
     ```
     For a **claude** worker that is `claude --model <m> -n "<task-name>"
     "/work-system:continue"` — `-n` names the session (shown in `/resume`),
     `/work-system:continue` runs the resume flow (load TASK.md, commits, progress).
     Use the plugin-qualified form: a Claude Code built-in `/continue` shadows the bare
-    skill. For **codex/grok** it's `codex -m <model> '<bootstrap prompt>'`. Do **not**
+    skill. **codex/grok/kimi** get the bootstrap prompt instead; kimi's is a two-phase
+    form the registry emits (see `/kickoff` step 13b). Do **not**
     execute the `cd` yourself — it is for the user's new terminal. If `resolve` exits
     non-zero (2 unknown / 3 unavailable), surface that instead and re-offer the picker.
     On the picker's "save default" path, persist only after the user confirms the worker
diff --git a/plugins/work-system/skills/close/SKILL.md b/plugins/work-system/skills/close/SKILL.md
index d2a785e..9bf15c2 100644
--- a/plugins/work-system/skills/close/SKILL.md
+++ b/plugins/work-system/skills/close/SKILL.md
@@ -271,13 +271,13 @@ Rules:
     tab matched, `/close` is already done — stop here.
 
     **Worker-agent degradation (why this is CLI-safe).** `/kickoff` can launch a
-    codex/grok worker, not just claude — but the teardown needs no per-worker
+    codex/grok/kimi worker, not just claude — but the teardown needs no per-worker
     branching. Scenario A closes a *different* tab with `close-tab`, a tab-level
     herdr op that works for any CLI (the idle worker dies with the tab). Scenario B
     (`self-exit` injects `/exit`, backed by the plugin `SessionEnd` hook) is
     claude-specific — but it is only ever reached from *inside* a claude session
     (`SELF=yes` means this Claude Code session **is** the worktree tab, and only a
-    claude session can run `/close`). So `/exit` is never injected into a codex/grok
+    claude session can run `/close`). So `/exit` is never injected into a non-claude
     worker: a non-claude worker tab is always the *other* tab and closes via
     Scenario A. Do **not** add a self-exit path for non-claude workers. **Only proceed if the cleanup
     above (steps 7–10) actually completed**: if any step stopped for a confirmation
diff --git a/plugins/work-system/skills/continue/SKILL.md b/plugins/work-system/skills/continue/SKILL.md
index 7220fa8..8e4dbc9 100644
--- a/plugins/work-system/skills/continue/SKILL.md
+++ b/plugins/work-system/skills/continue/SKILL.md
@@ -55,13 +55,14 @@ the prefix-stripped task name) — comparing the raw argument instead misroutes.
 > not persist which worker a task used (per-task agent memory is a later idea), so
 > resume can't dispatch per CLI. The tab-reopen itself is CLI-agnostic (it just
 > reopens a tab at the worktree cwd), but the `claude -c` it runs resumes a
-> **claude** worker only. So if the task was kicked off with **codex/grok**
-> (`/kickoff … --codex`/`--grok`/…), that `claude -c` starts a *new claude*
+> **claude** worker only. So if the task was kicked off with **codex/grok/kimi**
+> (`/kickoff … --codex`/`--grok`/`--kimi`/…), that `claude -c` starts a *new claude*
 > session, not the original worker. **Surface this inline** whenever you reopen:
-> tell the user that `claude -c` was sent and, for a codex/grok task, to run the
-> worker's own resume in the tab instead — `codex resume --last` (codex) or
-> `grok -c` (grok). Everything git/PR-derived (`/status`, `/list`, the `[ws]`
-> statusline) already works for any worker; only session-resume is claude-shaped.
+> tell the user that `claude -c` was sent and, for such a task, to run the
+> worker's own resume in the tab instead — `codex resume --last` (codex),
+> `grok -c` (grok), or `kimi -c` (kimi). Everything git/PR-derived (`/status`,
+> `/list`, the `[ws]` statusline) already works for any worker; only
+> session-resume is claude-shaped.
 
 1. **Resolve the task's worktree:**
    - Get the prefix-stripped `task_name`: if you arrived here from the `linked` branch
@@ -135,14 +136,14 @@ the prefix-stripped task name) — comparing the raw argument instead misroutes.
    it. If you land on a bare shell instead: if a shell startup prompt ate the command,
    run `claude -c` there yourself; if this worktree never hosted a session (e.g. it came
    from `/adopt`), `claude -c` has nothing to resume — start fresh with `claude`.
-   If this task was kicked off with a codex/grok worker, that `claude -c` is a NEW
+   If this task was kicked off with a codex/grok/kimi worker, that `claude -c` is a NEW
    Claude session, not your worker — resume the worker instead: `codex resume --last`
-   (codex) or `grok -c` (grok) in the tab.
+   (codex), `grok -c` (grok), or `kimi -c` (kimi) in the tab.
    ```
    Word it as *sent*, not "is running" — the helper delivered the keystrokes but can't
    confirm Claude actually came up (see the shell-startup race in the knowledge entry).
-   Always include the codex/grok line: the reopen can't tell the worker, so the caveat
-   must be inline, not left to the top-of-section note.
+   Always include the non-claude worker line: the reopen can't tell the worker, so the
+   caveat must be inline, not left to the top-of-section note.
 
    **b) Outside herdr — manual block** (display this — do **not** execute the `cd`):
    ```
diff --git a/plugins/work-system/skills/kickoff/SKILL.md b/plugins/work-system/skills/kickoff/SKILL.md
index dd54f94..9c22680 100644
--- a/plugins/work-system/skills/kickoff/SKILL.md
+++ b/plugins/work-system/skills/kickoff/SKILL.md
@@ -2,7 +2,7 @@
 name: kickoff
 description: |
   Creates an isolated `task/<name>` worktree off main and opens a worker
-  session there (Claude, codex, or grok — your pick).
+  session there (Claude, codex, grok, or kimi — your pick).
   Trigger: "start working on X", "kickoff", "create a worktree".
 user_invocable: true
 ---
@@ -43,6 +43,7 @@ and `add-dark-mode` is the task. Every other selector is valueless. An optional
 | `--fable` / `--opus` | claude on fable / opus |
 | `--codex` / `--sol` | codex on gpt-5.6-terra / gpt-5.6-sol |
 | `--grok` | grok-4.5 |
+| `--kimi` | kimi-code on k3-256k (two-phase launch — see step 13b) |
 | `--agent <cli[:model]>` | any registry entry, e.g. `--agent claude:sonnet` or `--agent codex` |
 
 This table mirrors `agent-registry.sh` for reader convenience only — **never
@@ -121,19 +122,28 @@ is a per-repo committed file (`.claude/work-system-agent`), set via
     `REG="${CLAUDE_PLUGIN_ROOT}/scripts/agent-registry.sh"`.
 
     - **An explicit flag was given** (`--fable`, `--opus`, `--codex`, `--sol`,
-      `--grok`, or `--agent <cli[:model]>`): `SELECTOR` is that flag (for
+      `--grok`, `--kimi`, or `--agent <cli[:model]>`): `SELECTOR` is that flag (for
       `--agent`, the `cli[:model]` value, e.g. `claude:sonnet`). One-off — no
       default offer.
     - **No flag:** read the repo default: `SELECTOR="$(bash "$REG" default get)"`
       (the helper validates the committed value; a stale/unknown name prints
       empty, so it can't route the launch).
       - **Non-empty** → use it directly (the common path: no picker). **If that
-        default is a non-claude worker** (`SELECTOR` starts `codex:`/`grok:`),
+        default is a non-claude worker** (`SELECTOR` does not start with `claude:` —
+        a negative check, so a future registry CLI is covered without editing this),
         first **announce** it — e.g. "Launching **codex:gpt-5.6-sol** (project
         default) — this sends the task to a third-party model; pass `--pick` to
         choose another." This is a visibility line, **not** a prompt: a committed
         default from a cloned repo shouldn't silently route your code off-Claude,
         but it also shouldn't block. Claude defaults launch with no such line.
+    - **Whenever the resolved worker is `kimi:…`** — default, flag or picker alike —
+      the announce line must ALSO say it runs **unattended**: e.g. "kimi starts
+      working on TASK.md immediately, without tool-approval prompts." kimi is the
+      only worker that acts before you open the tab (`-p` seed + `--auto`), so
+      whatever TASK.md says is executed in a worktree holding your git credentials.
+      That is the intended shape, not a defect — but it must be visible, especially
+      for an `/adopt`-generated TASK.md, which is summarized from someone else's
+      commits. Still announce-not-prompt: state it, don't block.
       - **Empty** (no project default set, or the committed value was invalid) →
         fall through to the **picker** below.
     - **`--pick`, or no flag with no default set → the picker.** Run
@@ -172,8 +182,8 @@ is a per-repo committed file (`.claude/work-system-agent`), set via
     rides only on the tab label (what the sidebar renders); the agent and session
     names stay plain. The `task/<task-name>` branch is unchanged, so `/continue`
     still resolves the task inside the worktree. (Only a claude worker runs
-    `/continue` — codex/grok get a bootstrap prompt from the registry instead; see
-    step 12.) The worktree path is
+    `/continue` — codex/grok/kimi get a bootstrap prompt from the registry instead;
+    see step 12.) The worktree path is
     absolute (`<main-repo>/.claude/worktrees/<task-name>`, with `<main-repo>` from
     step 1). Then call the shared launch helper:
 
@@ -232,12 +242,14 @@ is a per-repo committed file (`.claude/work-system-agent`), set via
     bash "$REG" resolve "$SELECTOR" --session "<task-name>"
     ```
 
-    Take the `argv=` lines (in order) as the command words. **Shell-quote each
-    word** as you render the command — do NOT just space-join the raw values: for
-    codex/grok the whole bootstrap prompt is ONE `argv=` word containing spaces, so
-    without quotes the shell would split it into separate arguments and the CLI
-    would mangle/reject the prompt. Display this block — it is *not* a command to
-    execute:
+    Use the **`argv_shell=` line verbatim** as the command to show — it is the
+    `argv=` words already shell-quoted by the registry (`shell_quote`, POSIX
+    single-quoting). Do **not** re-derive it by joining the `argv=` words yourself:
+    quoting here is load-bearing, and for kimi it is safety-critical — one of its
+    words is a shell script carrying `;` and `exec`, so a mis-quoted render would
+    run the `;` in the **user's own interactive shell** and replace it with an
+    unattended agent. Copy the line as-is. Display this block — it is *not* a
+    command to execute:
     ```
     Worktree created!
 
@@ -250,15 +262,15 @@ is a per-repo committed file (`.claude/work-system-agent`), set via
        session — this session stays in the main repo) and run:
 
          cd .claude/worktrees/<task-name>
-         <the argv= words, each shell-quoted — e.g. codex -m gpt-5.6-sol 'Read TASK.md …'>
+         <the argv_shell= line, verbatim — e.g. codex -m gpt-5.6-sol 'Read TASK.md …'>
     ```
-    For a **claude** worker the command is `claude --model <m> -n "<task-name>"
-    "/work-system:continue"` — `-n` names the session (shown in `/resume`),
-    `/work-system:continue` runs the resume flow (load TASK.md, commits, progress).
-    Use the plugin-qualified form: a CC built-in/alias `/continue` shadows the skill,
-    so the bare word would run CC's own resume instead. For **codex/grok** it is
-    `codex -m <model> '<bootstrap prompt>'` (they have no work-system skills, so the
-    prompt tells them to read TASK.md and drive to a PR). Do **not** execute the `cd`
+    What that line contains is the registry's business, not this skill's — but so
+    the report reads sensibly: a **claude** worker resumes via `/work-system:continue`
+    (plugin-qualified, since a CC built-in `/continue` shadows the skill);
+    **codex/grok/kimi** have no work-system skills and get the bootstrap prompt
+    instead (read TASK.md, drive to a PR), with **kimi** launching in two phases
+    because it has no positional launch prompt and `-p` cannot be combined with
+    `--auto`. Do **not** execute the `cd`
     yourself — it is for the user's new terminal. If `resolve` exits non-zero
     (2 unknown / 3 unavailable), surface that instead and re-offer the picker.