* fix(ci): configure git identity before the docs-sync merge and classify merge failures
* fix(ci): hold the docs-sync watermark back until every PR has an outcome
* test(ci): self-check for the docs-sync failure paths
* fix(ci): isolate PR selftest concurrency from the daily docs-sync run
A provider can accept a request, return response headers, and then never
send a byte of body data. The connection-phase request timeout was cleared
as soon as headers arrived, so nothing bounded that wait and the agent turn
hung indefinitely after a tool call completed: step-finish:tool-calls was
recorded and the next step-start never arrived, with the HTTP server still
responsive.
Extend the same configured timeout deadline to the wait for the response
body's first byte. The connection-phase timer covers the fetch up to
headers; once headers arrive, the remaining deadline is handed to a
first-byte guard that aborts the request if no data arrives. After the
first byte the guard becomes a passthrough, so idle gaps inside an already
streaming response (reasoning, buffering, slow token generation) are never
touched and remain opt-in via chunkTimeout.
This is a transport-level signal (bytes on the wire, before any content)
rather than the absence of normalized AI SDK events, so it cannot fire on
long prompt processing or reasoning the way the reverted stream watchdog
did. timeout: false still disables the bound entirely.
Adds a hermetic regression test that injects a simulated stalled socket
through the provider's own fetch option via the plugin config hook, so the
SDK, Kilo's fetch wrapper, SSE parsing, the processor and the agent loop
all stay production code. The stalled request is transient, so the test
asserts the turn recovers by retrying and completing instead of freezing.
The test goes red without the fix (no retry, frozen at step-finish) and
green with it.
Refs #8656
* fix(cli): enforce permissions on shell commands the parser fails to scan
* fix(cli): fail closed on error chunks without command names, move pwsh execution test to kilo file
Passing the JETBRAINS_CERTIFICATE_CHAIN / JETBRAINS_PRIVATE_KEY multiline
secret content directly as certificateChain/privateKey Gradle properties
gets mishandled by the zip-signer CLI when signPlugin and
verifyPluginSignature run as separate Gradle invocations (#12567), causing
verifyPluginSignature to fail with 'Invalid argument: ***' as the masked
multiline content is split into extra CLI args.
Mirror script/build-version.sh: write the certificate chain and private
key to temp files under $RUNNER_TEMP and wire
certificateChainFile/privateKeyFile (file-based) into the intellij
signing extension instead of certificateChain/privateKey (raw content).
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
* test(cli): cover TUI startup outside package
* fix(cli): use native preload path in TUI test
---------
Co-authored-by: Johnny Eric Amancio <johnnyeric@gmail.com>
The Ctrl+T variant cycling shortcut hint was rendered in the TUI prompt footer hint row, gated on the active model exposing reasoning variants. It was accidentally removed during an upstream refactor (commit 81eb6e670b in anomalyco/opencode, "refactor(prompt): remove variant cycle display from footer").
- Add useCommandShortcut("variant.cycle") alongside the existing agent and command palette shortcuts
- Render the hint as the first item in the footer row, matching the original placement before agents/commands
- Gate visibility on local.model.variant.list().length > 0, matching the original upstream guard so the hint is discoverable as soon as the model exposes variants, regardless of whether one is currently selected
Whitebeard