opensource/kilocode
3
0
Fork 0
mirror of https://github.com/Kilo-Org/kilocode.git synced 2026-08-28 11:05:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: list deferred forbidden-string candidates and wire into upstream-merge agent

Browse Source 
Adds commented-out entries for the URLs/strings we want to ban once the
underlying call sites are rebranded, and tells the upstream-merge agent
to flag new upstream-attribution leaks for inclusion in the list.
This commit is contained in:
Mark IJbema
2026-05-18 15:32:24 +02:00
parent 3185e8d582
commit c224f5040d
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kilo/agent/upstream-merge.md
+9 -1
View File
@@ -249,7 +249,15 @@ be broken. Check every auto-merged file for:
files changed. Note that this tool compares against the merge base via `HEAD`
and will be silent until the merge commit lands
- other CI guards that touched files imply (knip for `kilo-vscode/`,
`check-kilocode-change`, source-links, visual regression)
`check-kilocode-change`, source-links, visual regression,
`script/check-forbidden-strings.ts`)
- if you encounter a hardcoded upstream URL, repo path, or attribution string
during conflict resolution that obviously shouldn't ship in Kilo (e.g. another
`https://opencode.ai/...` link, an `anomalyco/opencode` reference, an
attribution header naming "opencode"), suggest adding a literal pattern for
it to `script/check-forbidden-strings.ts` in the merge summary so future
merges catch it automatically. Don't add it silently mid-merge — flag it for
the user.
### 9. Commit with the standard message
script/check-forbidden-strings.ts
+12
View File
@@ -41,6 +41,18 @@ const forbidden: { pattern: string; reason: string; allow?: string[] }[] = [
},
{ pattern: `"HTTP-Referer": "https://opencode.ai/"`, reason: "attributes outbound LLM traffic to upstream" },
{ pattern: `"http-referer": "https://opencode.ai/"`, reason: "attributes outbound LLM traffic to upstream" },
// Candidates -- enable once the underlying call sites have been rebranded.
// Each one currently fires on real leaks; uncomment after fixing the listed
// file(s) (and add an allowlist if there are unavoidable legitimate hits).
//
// { pattern: "opencode.ai/auth", reason: "upstream auth URL -- providers.ts opencode-provider help text" },
// { pattern: "opencode.ai/go", reason: "upstream upsell URL -- dialog-go-upsell.tsx" },
// { pattern: "opencode.ai/docs", reason: "upstream docs URL -- config.ts schema descriptions, providers.ts cloudflare help" },
// { pattern: "opencode.ai/tui.json", reason: "upstream-hosted schema URL -- tui-migrate.ts" },
// { pattern: `?? "https://opncd.ai"`, reason: "default share base URL still points at upstream -- share-next.ts" },
// { pattern: "opencode.ai/theme.json", reason: "upstream-hosted theme JSON-Schema URL -- theme/*.json $schema fields" },
// { pattern: "opencode.ai/desktop-theme.json", reason: "upstream-hosted desktop theme schema URL" },
]
const isAllowed = (file: string, allow?: string[]) => {