[kimi-agent-bot]

Requirement or Bug

移除 Canary npm 发布的仓库变量开关，使后续 Canary 版本默认发布到 npm 的 canary dist-tag。npm 管理员已为 canary-release.yml 配置 Trusted Publishing；本次不改变 latest dist-tag。

Bug Reproduction Steps

N/A

Root Cause

N/A

Code Changes

 Canary publish workflow
- 通过 vars.KIMI_CODE_CANARY_NPM_PUBLISH 决定是否执行 npm 发布
+ 非 skip 的 publish job 默认执行 pnpm publish --tag canary
  保留 id-token、npm 11、registry、现有构建和 38 个 GitHub Release 资产流程

 stale-publish guard
- 仅在开关开启时读取 npm dist-tags.canary
+ 始终读取并校验 dist-tags.canary，继续防止旧版本覆盖新版本

未修改 stable release.yml、latest dist-tag、npm 包名、Canary 版本算法或其他发布流程。

Behavior Changes and Affected Users

Behavior	Before	After	Who relies on the old behavior	Escape hatch
npm Canary 发布	仅仓库变量显式为 true 时发布	非 skip 的 Canary publish job 默认发布到 canary dist-tag	使用 npm Canary 包的用户与发布维护者	无；这是发布维护者明确批准的默认变更，latest 不变
npm 防倒退检查	仅开关开启时把 npm 最新 Canary 纳入比较	始终纳入比较	重跑或补发 Canary 的工作流	无；保持原有保护语义
原有 opt-in 配置	可通过仓库变量关闭 npm 发布	变量引用被移除，不再提供该开关	曾设置该变量的发布配置	无；发布维护者已明确批准

受影响模块与验证：

• .github/workflows/canary-release.yml：YAML 解析通过；id-token: write、npm 11、registry、构建和 GitHub prerelease 步骤保留。
• scripts/canary-release.mjs / scripts/canary-release.test.mjs：相关脚本测试 20/20，通过；新增测试证明 npm dist-tag 查询始终执行、空值可接受、异常版本会失败。
• 全仓：pnpm run typecheck 与 pnpm run lint 均通过；git diff --check 通过；KIMI_CODE_CANARY_NPM_PUBLISH 残留引用为 0。
• 按发布维护者要求，本 PR 不新增 changeset。
• 未 dispatch 生产 Canary、未实际发布 npm、未修改 stable 或其他职责。

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (需求由发布维护者直接提出，无单独 issue).
• I have added tests that prove my feature works.
• The behavior-change table above is complete；默认变更已获发布维护者明确批准，并按其要求不新增 changeset。
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d23550b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T07:12:50.558357Z	d23550b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@d23550b

npx https://pkg.pr.new/@moonshot-ai/kimi-code@d23550b

commit: d23550b

[kimi-agent-bot]

@codex review
增量评审：请只审自上次评审以来的新增 commit；未变更代码请勿重复提出；已 resolve 的主题仅当核实现状代码确已修复或不再成立时才抑制（其余约定同首轮）。

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: d23550b7de

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".