* fix(ci): pass --auto to the docs-sync kilo runs and keep full stderr logs
Headless kilo run auto-rejects every permission ask it receives, and the
GitHub runner has no user config granting bash — so without --auto the
docs-sync bot's triage, edit and verify-fix calls were silently crippled
whenever the agent reached for a non-allowlisted shell command (CI run
30306629290: 9 rejections, all 11 edit batches failed, exit 0).
- Pass --auto immediately after "run" at all three call sites
(triage.mjs, edit.mjs, docs-sync.yml Fix verify failures step)
- runKilo now always writes the child's full stderr to
docs-sync-out/kilo-stderr-<label>.log, on success as well as failure —
the blindness that hid the defect
- selftest asserts --auto non-vacuously (region-scoped source match +
a stub invocation that records argv) and proves the stderr log is
written on both the failure and the summary-writing success path
* fix(cli): exit nonzero when a headless run auto-rejects or its session errors
Non-interactive kilo run reported success for runs that accomplished
nothing — a caller cannot distinguish success from a dead run, which is
why the docs-sync bot had to stop trusting exit codes entirely.
- Plain headless run (neither --auto nor --dangerously-skip-permissions)
in which the CLI auto-rejected at least one permission ask now exits
non-zero, even when the session still reaches idle afterwards, with
the diagnostic: run ended with an auto-rejected permission; pass
--auto for autonomous use. Deliberate contract change: any
auto-rejected ask means the run was crippled, not successful.
- A mid-stream session error now writes its diagnostic to stderr before
emitting the json error event, so the cause is visible under
--format json as well (the emit-first shape skipped the stderr write).
- The old exit-0 contract lock-in test is replaced: its llm.fail fixture
never published a consumable session.error, so it locked in a false
premise. New tests cover both scenarios in both output formats;
happy-path and --format json runs still exit 0 unchanged.
* fix(ci): redact secret env values from persisted kilo stderr logs
The full-stderr capture added for observability lands in uploaded CI
artifacts, which are raw files (GitHub masks secrets in log streams
only) on a public repo, and the runner env holds a long-lived
KILO_API_KEY. Redact exact values of KEY|TOKEN|SECRET-named env vars
(len >= 8) once at capture, so both the console tail and the artifact
file are safe. Adds the changeset for the headless exit-code contract
change.
* fix(ci): redact secrets from persisted kilo stdout and harden redaction
The docs-sync workflow uploads docs-sync-out/ as a public 14-day artifact,
and kilo stdout was persisted raw there in two more places: triage-raw-*.txt
and the edit-log.txt tee. Redact at capture in runKilo for stdout as already
done for stderr, and pipe the verify-fix step's kilo stdout through a new
line-wise redact-stream.mjs filter before tee.
Also harden redactEnvSecrets: widen the name pattern to
KEY|TOKEN|SECRET|CREDENTIAL|PASSWORD|ORG_ID|_PAT (KILO_ORG_ID is a repo
secret), replace longer values first so a short secret that prefixes a
longer one cannot leak the remainder, and document the exact-substring
limitation. Selftest gains cases 2e (prefix ordering), 2f (stdout capture),
2g (stream filter) and a non-vacuous exact-line assertion in 2d.
* fix(cli): correct the headless-exit changeset's json-format claim
The auto-reject path adds a new error event to the --format json stream;
only the existing event shapes are unchanged. Also state that the exit-1
rule covers a plain non-interactive --attach run that auto-rejects an ask.
* fix(ci): document --auto security trade-off and deferred hardening
Update comments in triage.mjs and edit.mjs to accurately describe the
security implications of --auto (unrestricted bash for an agent steered
by external PR content) and note that a scoped permission.bash map via
KILO_CONFIG_CONTENT is the intended hardening, deferred until required
shell patterns are stable.
* fix(ci): raise docs-sync budgets so the backlog can actually drain
--auto fixes the batches the bot attempted; it does not fix the ones it
never started. In run 30306629290 (254 PRs collected, 51 docs-worthy),
the wall-clock budgets deferred 54 PRs untriaged and 31 unedited without
an attempt — 45 of the 60 pending rows on the rolling PR. Triage got 8 of
11 chunks in 35 min; edit got 4 of 11 batches in 50 min.
Both are ceilings, not costs. A caught-up run needs ~2 chunks and ~1
batch and finishes in ~25 min, so raising them spends nothing on a normal
day and drains the backlog on a bad one. 90/120 covers 20 chunks and 14
batches — 500 triaged and 70 edited PRs against a ~5 docs-worthy/day
inflow — inside a 240-minute job timeout.
Also strip ANSI CSI sequences in tailText, the shared path both triage
and edit route their pending causes through. kilo renders its TUI to
stderr, so every "Why" cell on the rolling PR currently reads
"^[[0m→ ^[[0mRead packages/..." instead of the diagnostic. The persisted
docs-sync-out/kilo-stderr-*.log stays raw as the debugging record.
selftest case 2h asserts the pending reason is escape-free and still
carries the diagnostic text; case 2i asserts each budget fits at least
two units and the job timeout outlasts both, so a future edit cannot
silently restore a budget too small to run anything. Both shown failing
on the unmodified code first.
* fix(ci): keep the docs-sync rebuild authoritative in the fix step
The "Fix verify failures" step runs under `set -o pipefail` and the
default `bash -e`. Once the CLI half of this PR ships, `kilo run` exits 1
on a mid-stream session error, which aborts the block before the rebuild
runs: verify2.log is never written and `Re-verify status` reports
VERIFIED=false even when the docs build fine. A transient provider error
would flip every rolling docs PR to "Verification: failing".
The agent's exit code was never the signal for this step — the rebuild
is. Guard the pipeline with `|| echo ::warning::` so a nonzero kilo run
is surfaced but the rebuild still decides the outcome.
Extends selftest case 2b (which already parses this step) rather than
adding a case: the guard must appear between the pipeline's tee and the
rebuild, so a comment elsewhere in the block cannot satisfy it. Shown
failing with the guard removed.
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
A prompt sent while a session is running queues behind the active turn,
which breaks out of its loop after the current LLM step drains. That
handoff was recorded with close reason "interrupted", so the webview
rendered the yellow "Turn interrupted." card during the brief idle
window before the queued turn started.
The handoff now closes with a dedicated "superseded" reason instead.
Clients extend their close-reason unions and the webview suppresses the
terminal warning card for superseded turns; memory digests still treat
the cut-short turn as interrupted, and real user interruptions are
unchanged.
* feat(tui): register `/auto-approve` slash command for toggling auto-approve mode
The TUI already exposed auto-approve mode toggling through the command
palette (Ctrl+P -> "Enable/Disable auto-approve mode" backed by
`Permission.allowEverything`), but there was no slash command for it.
Promote the existing `permission.allow_everything` palette entry to a
slash command by adding `slashName: "auto-approve"` plus a few common
aliases (`autoapprove`, `approve-all`, `approveall`) and a `desc` for
autocomplete. The slash command dispatches the same palette entry, so
behavior, gating, and toasts stay identical to the Ctrl+P path.
- packages/opencode/src/kilocode/cli/cmd/tui/app.tsx
* fix(tui): clarify /auto-approve desc reads from global config
Add a new Kilo-REST Exa transport alongside the existing MCP-Exa
and MCP-Parallel transports. When the websearch tool picks the Exa
provider and the user is signed into Kilo, requests go to
https://app.kilo.ai/api/exa/search with the user's Kilo bearer.
The cloud proxy injects its own Exa API key; the client sends the
user's Kilo API key as a Bearer token. The MCP-BYOK path (EXA_API_KEY)
and MCP-unauthed fallback are preserved unchanged.
Changes:
* New `packages/opencode/src/kilocode/tool/websearch-kilo-exa.ts`
implements `callKiloExa` against the Exa REST API
(`POST /search`) with `{ highlights: true }` contents and clamps
numResults at 10 (Exa's first-10-results flat $0.007 tier).
* `packages/opencode/src/tool/websearch.ts` adds a `"kilo-exa"`
provider variant (selected only via `KILO_WEBSEARCH_PROVIDER`
override), an Auth.Service yield to source the Kilo bearer, a
transport-dispatch block that prefers Kilo-REST over MCP when
auth is available and EXA_API_KEY is unset, and `transport`
metadata on the tool part. MCP-Exa numResults is now clamped
at 10 (default stays 8).
* 13 unit tests in
`packages/opencode/test/kilocode/tool/websearch-kilo-exa.test.ts`
cover request shape, response formatting, error handling, and
the costDollars ignore case.
* Parameters snapshot updated for the new numResults description
string.
* Patch-level changeset added.
The headless path printed `${urls.local}/console` and `${urls.network}/console` without basic-auth credentials, leaving remote or display-less users unable to reach the console.
Rename `browserUrl` to `withCredentials(base, state)` so credentials are embedded into any base URL, and use it for both the printed Local/Network URLs and the in-process browser launch (which previously used `state.url` directly and now matches what the user would see if they copy/pasted the Local URL from the terminal).
A provider can accept a request, return response headers, and then never
send a byte of body data. The connection-phase request timeout was cleared
as soon as headers arrived, so nothing bounded that wait and the agent turn
hung indefinitely after a tool call completed: step-finish:tool-calls was
recorded and the next step-start never arrived, with the HTTP server still
responsive.
Extend the same configured timeout deadline to the wait for the response
body's first byte. The connection-phase timer covers the fetch up to
headers; once headers arrive, the remaining deadline is handed to a
first-byte guard that aborts the request if no data arrives. After the
first byte the guard becomes a passthrough, so idle gaps inside an already
streaming response (reasoning, buffering, slow token generation) are never
touched and remain opt-in via chunkTimeout.
This is a transport-level signal (bytes on the wire, before any content)
rather than the absence of normalized AI SDK events, so it cannot fire on
long prompt processing or reasoning the way the reverted stream watchdog
did. timeout: false still disables the bound entirely.
Adds a hermetic regression test that injects a simulated stalled socket
through the provider's own fetch option via the plugin config hook, so the
SDK, Kilo's fetch wrapper, SSE parsing, the processor and the agent loop
all stay production code. The stalled request is transient, so the test
asserts the turn recovers by retrying and completing instead of freezing.
The test goes red without the fix (no retry, frozen at step-finish) and
green with it.
Refs #8656
* fix(cli): enforce permissions on shell commands the parser fails to scan
* fix(cli): fail closed on error chunks without command names, move pwsh execution test to kilo file
* fix(cli): drain session ingest queue on shutdown and flush terminal batches promptly
* fix(cli): drain the session ingest queue on process shutdown
* fix(cli): pin drain bound expiry, add changeset, conform to naming rule
* fix(cli): keep kilo-sessions out of the CLI startup import graph
* fix(cli): never let the ingest drain task reject the shutdown sequence
* test(cli): pin drain-before-dispose ordering on the KiloCli shutdown path
* fix(cli): make the guarded ingest drain non-rejecting and correct the lazy-import rationale
* test(cli): cover the retryable-status drain path under shutdown
* test(cli): decouple cli-shutdown drain assertions from declaration order
* fix(cli): advertise the instance from enableRemote so /remote registers as a spawn target
Enabling the remote relay from the TUI `/remote` slash command connected the
socket and mirrored sessions, but never advertised the instance, so the CLI
never appeared as a spawn target in the mobile "Run on" picker. Only the
explicit `kilo remote` command called setInstanceAdvertisement.
The advertisement now runs on every successful enableRemote() entry, before the
already-connected and coalescing early returns. That ordering matters: bootstrap
auto-enable frequently connects first, so `/remote` usually hits
`if (remote) return` and an advertisement placed in the connection-setup body
would leave the defect unfixed in the common case. `ingestDisabled` returns
before the advertisement and stays unadvertised.
The ensure helper is a no-op when an advertisement is already set, so it fires no
extra heartbeat, while explicit setInstanceAdvertisement keeps its existing
replace semantics. buildInstanceAdvertisement moves to a shared module so the
command path and the enable path derive it identically.
* fix(cli): report pending question and permission on the session heartbeat
The heartbeat built each session's status from SessionStatus.Service, whose
union is idle/retry/busy/offline and which never consults Question.Service or
Permission.Service. deriveStatus() already did consult both, but only fed the
ingest session_status sync. So a session genuinely blocked on a question was
advertised as busy on the heartbeat, and the mobile app — which takes live row
status from the heartbeat — showed no needs-input badge.
Extract the precedence (permission, then question, then SessionStatus) into a
shared helper used by both deriveStatus and the heartbeat, so the two channels
cannot drift.
The heartbeat runs on a ~10s timer across every session, and deriveStatus makes
service calls per session, so the permission and question lists are fetched once
per tick and indexed by session id rather than queried per session. A test pins
the call count.
Behaviour note beyond the strict fix: sharing the derivation also means a
SessionStatus of offline now reports as retry on the wire, matching what
deriveStatus has always sent to ingest. Nothing consumes offline from the
heartbeat — the transport forwards only idle and busy, and the mobile row treats
both as non-attention — so the effect is that the two channels now agree. The
detach fence test is parameterised accordingly; its assertion that the status
clears on detach is unchanged.
* chore(cli): widen the promise-facade allowlist for the heartbeat attention tests
The DEF-3 heartbeat tests raise and reply to real Question and Permission
requests through the global AppRuntime, which took kilo-sessions.test.ts from 4
classified references to 29 and failed the allowlist check.
Bumping the count rather than restructuring the tests is deliberate: the
heartbeat resolves attention status from the global Question.Service and
Permission.Service, so asserting it requires driving those same services.
Scoped layers cannot express that — the global-runtime coupling is the thing
under test — and it is the same integration pattern this entry already
sanctioned for the detach fence. The reason string records that.
Marius