* feat: add WarpGrep AI-powered codebase search tool
Add WarpGrep integration as a new tool for intelligent multi-step
codebase search. WarpGrep delegates search to Morph's RL-trained
search agent, which runs parallel tool calls across multiple turns
and returns only relevant code spans.
- Add WarpGrep core client with multi-turn API loop, local tool
executors (ripgrep, file read, directory list), and XML parsing
- Add tool definition gated behind KILO_ENABLE_WARPGREP flag
- Register tool in registry with feature flag gating
- Add warpgrep permission to orchestrator, ask, and explore agents
- Conditionally enhance explore agent prompt when WarpGrep available
- Add unit tests for parsing, file ops, and tool registration
* fix: align warpgrep with Morph XML protocol
* chore: drop warpgrep test changes from branch
* chore: remove warpgrep test files from branch
* refactor: replace custom WarpGrep implementation with @morphllm/morphsdk
- Delete 396-line custom warpgrep.ts, replace with SDK's WarpGrepClient
- Only check MORPH_API_KEY (drop WARPGREP_API_KEY)
- Route through Kilo proxy during free period when no API key is set
- Add actionable error message for when free period ends
- Grep for FREE_PERIOD_TODO to find what to change post-free-period
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: rename warpgrep to codebase_search, add error toast for 429/402
- Rename tool from warpgrep to codebase_search throughout
- Switch proxy URL to /api/gateway
- Detect auth/rate-limit errors (401/402/429) and show actionable
fallback message telling users to set MORPH_API_KEY
- Fire a TUI toast notification on auth/rate-limit errors so users
see a visible popup, not just hidden tool output
- Wire up GlobalBus "global.event" in TUI thread so Bus events from
tools can reach the TUI event system
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* build: bump @morphllm/morphsdk to 0.2.141
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use Bus.publish for toast, revert global.event subscription
Address PR review: emit toast via Bus.publish(TuiEvent.ToastShow)
instead of GlobalBus.emit() so it works in both direct-RPC and
server-backed TUI modes. Revert the global.event subscription in
createEventSource since it's no longer needed and caused double
event delivery.
Also update codebase_search tool description to clarify natural
language input.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add codebase search toggle to experimental settings
Replace KILO_ENABLE_WARPGREP env var with a UI toggle in the
Experimental settings tab. The tool is now gated by the
experimental.codebase_search config field, accessible from both
VSCode settings and TUI config file.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update packages/opencode/src/tool/warpgrep.ts
Co-authored-by: Marius <marius@kilocode.ai>
* feat: limit codebase_search output to prevent context bloat
When search results exceed 45k chars (~15k tokens), degrade to showing
file paths and line ranges instead of full content. Also bumps
@morphllm/morphsdk from 0.2.129 to 0.2.147.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* build: bump @morphllm/morphsdk to 0.2.148
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: format codebaseSearch i18n strings to respect prettier line width
* fix: only advertise codebase_search in explore prompt when feature flag is enabled
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Christiaan Arnoldus <christiaan.arnoldus@outlook.com>
Co-authored-by: Marius <marius@kilocode.ai>
Disable the catch-all proxy route that forwards unmatched requests to
app.opencode.ai. This proxy served static assets from an external domain,
which raises privacy/security concerns as users' requests are sent to a
third-party host.
The catch-all route now returns a 404 instead of proxying. The proxy
import is commented out. Changes are marked with kilocode_change markers
to keep upstream merge diffs minimal.
* fix: renamed pattern arrays used for permission rules
* fix: rename savePatternRules to saveAlwaysRules
* feat: generate hierarchical always patterns in bash tool
* feat: validate saveAlwaysRules against always array only
* feat: pass always field through extension bridge to webview
* feat: show hierarchical always patterns in PermissionDock dropdown
* fix: rename pattern to rule in PermissionDock translations, styles, and data-slots
* fix(vscode): correct auto-run comment in PermissionDock
* feat(kilo-vscode): strip trailing wildcard from permission rule labels
* fix: deduplicate permission rules and strip wildcards from display labels
* refactor: move hierarchy to metadata.rules, restore always to arity prefix
* feat: pass always field to permission dock for non-bash tool rules
* fix: correct bash test assertion to check metadata.rules and fix indentation
* fix: hide permission rules dropdown for non-bash tools
* fix: align always-rules route descriptions, whitespace, and restore multi-command tests
The $schema URL in source code and documentation referenced
https://kilo.ai/config.json which returns 404. The correct URL
is https://app.kilo.ai/config.json (already used in test files).
Updated all remaining references in:
- packages/opencode/src/config/config.ts (4 occurrences)
- packages/kilo-docs/pages/code-with-ai/platforms/cli.md (4 occurrences)
- packages/kilo-docs/pages/customize/custom-subagents.md (1 occurrence)
Fixes#7063
* fix: use direct generateText for prompt enhancement instead of LLM.stream
* fix: guard temperature for models that disable it, move instruction to system message
- Check model.capabilities.temperature before setting temperature
- Move the enhance instruction to a system message to prevent user text
from overriding the instruction via prompt injection
Agent.remove() now also scans the .kilocodemodes YAML files that
ModesMigrator reads (VSCode global storage, ~/.kilocode/cli/global/,
~/.kilocodemodes, project .kilocodemodes) and removes the matching
entry by slug, so migrated modes don't reappear after deletion.
Replace the config disable:true approach with a proper Agent.remove()
function that scans config directories for the agent's markdown file
and deletes it, then refreshes state via Instance.dispose().
- Add Agent.remove() in agent.ts with RemoveError
- Add POST /kilocode/agent/remove route
- Mount KilocodeRoutes in server.ts
- Update KiloProvider to call the new backend route
- Regenerate SDK
File paths as query parameters can fail due to URL encoding issues.
Switch to POST /kilocode/skill/remove with the location in the JSON
request body, which avoids encoding problems entirely.
Also log the SDK error response to aid debugging.
The DELETE endpoint was returning data that somehow rendered as empty
rows in the webview. Simplify the approach:
- Webview optimistically removes the skill from its signal immediately
- Extension fires DELETE to the backend (deletes from disk + cache)
- Extension invalidates cachedSkillsMessage so next tab visit fetches
fresh data
- No second skillsLoaded message is sent after removal, avoiding the
stale data overwrite that caused the UI corruption
The DELETE /kilocode/skill endpoint now returns the updated skills
list (Skill.Info[]) instead of a boolean. The extension uses this
response directly to update the webview, eliminating the need for a
separate GET /skill round-trip that could return stale cached data.
Also normalize paths in Skill.remove() with path.resolve() to ensure
location strings match regardless of path format differences.
Rename routes/skill.ts to routes/kilocode.ts with KilocodeRoutes
export, mounted at /kilocode. This is the single home for all future
kilo-specific CLI endpoints, avoiding conflicts with the existing
/kilo gateway routes and keeping all kilo changes out of server.ts.
SDK: client.kilocode.removeSkill()
Extract the inline DELETE /skill endpoint from server.ts into a
dedicated packages/opencode/src/server/routes/skill.ts file, reducing
kilo-specific changes in the shared server.ts and minimizing future
merge conflicts with upstream.
The route is mounted at /skill and uses the same lazy() pattern as
other kilo-specific route files (telemetry, enhance-prompt, etc.).
Add Skill.remove() that deletes the skill directory from disk and
mutates the cached Instance.state in-place so subsequent GET /skill
calls return the updated list.
Add DELETE /skill?location=... server endpoint, regenerate the SDK,
and update KiloProvider to call the SDK method instead of deleting
files directly from the extension.
readMcpSettings() called JSON.parse() without try/catch. In migrate(),
if .kilocode/mcp.json existed but contained malformed JSON, the uncaught
exception propagated out of the dual-read loop, preventing .kilo/mcp.json
from ever being read. The outer loadMcpConfig() catch returned {} instead
of the valid config — silently losing MCP server configuration.
Wrap the file read + parse in try/catch, log a warning, and return null
so the loop continues to the next config directory.
Regression tests added for both readMcpSettings (unit) and migrate
(integration) to prove the bug and verify the fix.
Refs: #6881
Co-authored-by: marius-kiloclaw <marius-kiloclaw@users.noreply.github.com>
The upstream merge (v1.1.54) overwrote Kilo-specific URL handling with
the opencode ShareNext flow, breaking import for app.kilo.ai/s/ URLs.
Restore parsing of https://app.kilo.ai/s/<id> and fetching from
ingest.kilosessions.ai instead of the opncd.ai share API.
* fix: use .kilo instead of .kilocode for config directories
* fix: keep global ~/.kilocode untouched for legacy CLI compat
Only rename project-level .kilocode/ to .kilo/. The global ~/.kilocode
directory must stay because legacy CLI instances and legacy-migration.ts
in kilo-gateway still read from it.
* test: update VS Code extension tests to use .kilo directory paths
* fix: correct paths.ts comment and use specific git exclude entries
- Fix comment referencing ~/.kilo when globalDir() returns ~/.kilocode
- Revert to specific .kilo/ git exclude entries instead of blanket .kilo/
to avoid hiding user-authored rules/workflows/config from git status
* fix: handle legacy per-worktree metadata and stale paths in state
- readMetadata() falls back to .kilocode/ inside worktrees since the
per-worktree metadata dirs aren't renamed by the top-level migration
- Rewrite stale .kilocode/ paths in agent-manager.json on load
* fix: run .kilocode migration at extension activation, not just Agent Manager
Move migration call to the top of activate() so it runs for all users
on every extension startup, before kilo serve is spawned or any code
reads from the .kilo directory.
* fix: update git worktree refs after .kilocode → .kilo rename
After renaming the directory, git's internal .git/worktrees/*/gitdir
files still reference the old .kilocode path. This causes git to lose
track of worktrees, leading to crashes. Both the CLI and extension
migration now rewrite these gitdir files after a successful rename.
* fix: read from both .kilo and .kilocode, write to .kilo
Replace the one-time directory rename migration with a dual-read strategy:
- CLI config (rules, workflows, skills, MCP, project-id): read from both
.kilo/ and .kilocode/ directories, with .kilo taking precedence
- Agent Manager data (worktrees, state, setup scripts): migrate from
.kilocode/ to .kilo/ at startup since the extension exclusively owns these
- Config discovery (paths.ts, config.ts): include .kilocode in directory
and agent/command pattern matching
Key decisions:
- .kilo/ is the new canonical write location for all new data
- .kilocode/ is read as a legacy fallback (no data loss for existing users)
- No directory rename: both dirs can coexist safely
- Agent Manager migration is item-level (moves individual files), not a
full directory rename, so it handles both-dirs-exist gracefully
- Windows path rewrite in WorktreeStateManager handles both / and \ separators
- Workflow/MCP load order: .kilocode first, .kilo second (last wins)
- Rules dedup via seen-set with .kilo checked first (first wins)
- Delete migrate-kilo-dir.ts (no longer needed)
* fix: resolve .git file when fixing worktree refs during migration
When the project root is itself a worktree, .git is a file pointing
at the shared git dir, not a directory. Follow the gitdir pointer to
find the actual .git/worktrees/ location.
* fix: recover partial .kilo migrations and global dirs
Always repair stale git worktree refs when .kilo worktrees already exist so partially migrated repos recover on startup. Also dual-read global skills, rules, and workflows from both legacy and new home directories.
* fix: keep .kilo ahead of legacy config dirs
* fix: narrow legacy agent manager excludes
* chore: link migration cleanup follow-up
Catriel Müller