* feat(opencode): remote create_session fields, rename adoption, title sync
Extend create_session wire with optional agent/model/orgId (strict v1,
old-CLI degrade via client retry); claim org via session metadata
(metadata > KILO_ORG_ID > auth); adopt system session.renamed via
setTitle with consume-on-failure adoption marks; POST generation-aware
title changes through readiness (auto-titles marked by ensureTitle,
same-title Updated consumes pending adoptions).
* test(opencode): prove cancel→reprompt reaches idle; lock exit survivor
Item 14 CLI prove-it at SessionPrompt level: cancel-when-idle,
mid-stream, mid-tool, queued follow-up (deterministic queue wait), and
abortIntakes all settle to idle and reprompt completes — no production
hang found, no src change. Item 8: lock survivor session send_message
after sibling exit_cli.
* test(opencode): drop AppRuntime spy from create_session default test
Satisfies check-opencode-promise-facades while still proving the
production default forwards {agent, model, metadata} into
Session.Service.create.
* fix(opencode): bound rename marks, wire title report path, harden title tests
Kilobot review on #12704: adoption/auto-title maps now carry timestamps,
prune on write (60s TTL), and clear on Session.Event.Deleted (exported
clear/clearAll); the Updated watcher calls the interface
reportSessionTitle and fullSync passes preloaded info into meta();
ensureTitle's Kilo logic lives in kilocode/session/prompt.ts behind one
kilocode_change call site; title tests poll instead of sleeping and lock
mark-before-write plus clear-on-failure for real; meta() get-failure
org fallback covered via the _metaForTests seam.
* fix(kilo-sessions): mark bookkeeping before ingest sync, AppRuntime, test cleanup
Kilobot round 2 on #12704: consume rename/auto-title marks before the
ingest.sync network hop so the 60s TTL spans only the in-process hop;
call reportSessionTitle via AppRuntime.runPromise; auth cleanup back
under Effect.ensuring; restore the upstream blank line in prompt.ts so
the fork diff is only the kilocode_change call site.
* fix(kilo-sessions): keep title report self-healing if ingest.sync fails
Advance knownTitles only after successful sync; restore consumed rename/
auto-title marks on failure so the next Updated can re-POST. IIFE keeps
const-style outcome derivation.
* fix(kilo-sessions): optimistic knownTitles with full title-path rollback
Advance knownTitles before the network hop so concurrent Updated handlers
see sameTitle and cannot POST the same title with a wrong generated flag.
Restore prev + consumed marks when ingest.sync throws or reportSessionTitle
returns not-ok, so the next Updated retries the full self-healing path.
* style(kilo-sessions): prettier title Updated handler
* fix(kilo-sessions): preserve newer title state
* refactor(kilo-sessions): simplify title reporting tests
* fix(kilo-sessions): report unseeded title updates
* fix(kilo-sessions): consume unseeded title marks
* test(kilo-sessions): cover unseeded title marks
* test(kilo-sessions): unique ids for unseeded title tests
Thread a distinct session id through unseededMockSessionLayer so
session_share Storage records do not couple the three unseeded cases.
* fix(cli): stabilize Windows CI tests and rebalance slow shards
Three Windows-only instabilities in the CLI unit suite:
1. httpapi-instance-route-auth.test.ts failed with an uncaught
"Invalid handle" error. The test's ConfigProvider.layer(
fromUnknown(...)) replaced the ambient config provider, blinding
KILO_EXPERIMENTAL_DISABLE_FILEWATCHER=true that CI/preload sets. With
the flag hidden, the @parcel/watcher Windows backend subscribed on the
temp repo's .git; the tmpdir fixture then deleted that directory while
the never-disposed per-test runtime still held the subscription, and
CreateFileW failed with the hardcoded "Invalid handle" (napi rejection
with no JS stack). Add the disable-filewatcher flag to every test
config map that boots instances via the HttpApi app (instance-route-auth,
cors, ui, exercise backend, kilo-edit, memory).
2. config-overlay.test.ts intermittently returned HTTP 500 on Windows.
Filesystem.write's atomic temp-file+rename had no retry for Windows
transient locked-file errors (EPERM/EACCES/EBUSY) from Defender/indexer
and the detached background plugin install racing the rename in the same
tmpdir. Mirror the proven cleanup.ts locked-error retry pattern with a
short backoff, Windows-only.
3. Windows shards were badly imbalanced: the sharder weighted files by
byte size, which concentrated every slow spawn/FS/lock-heavy file
(snapshot, prompt, provider, run-process, instance-bootstrap,
httpapi-session) into one shard (~612s vs ~356s siblings), and the
resulting contention forced whole-file retries that doubled cost. Add
TestShard.timedWeight and a committed test-timings.json seeded from CI
junit data so shards balance by measured runtime (spread collapses from
~200s to ~18s) and contention-prone files spread across shards.
Platforms without manifest entries fall back to size weighting.
* fix(cli): skip stale manifest entries in timed shard weighting
Bun.file().size returns 0 (never throws) for missing paths, so the
try/catch in timedWeight was dead code and stale/renamed manifest entries
added their time to the scale numerator with zero size, inflating the
size-to-time ratio that estimates unknown files. Skip entries with a
non-positive on-disk size instead of catching a throw that never happens.
* revert(cli): drop hardcoded test-timings manifest
The committed test-timings.json (482 entries) was a maintenance burden:
it goes stale as tests are added/renamed and no size-based heuristic can
replace it (slow subprocess outliers like run-process.test.ts are 7kb but
112s, 10x the runtime-per-byte of other files). Revert the timing-weighted
sharding to the prior size-based LPT. The Windows reliability fixes
(ConfigProvider filewatcher flag + Filesystem.write locked-file retry)
remain and are what eliminate the failures and the ~360s of retry overhead
that dominated the 12m50s shard. A maintainable runtime-based rebalance
(self-updating CI cache fed from the junit artifacts CI already uploads)
is a separate follow-up.
The auth mode probes every protected route with valid credentials to
prove the route accepts them. Two routes intentionally block after a
valid request: tui.control.next waits for queued TUI input, and
instance.reload can outlive the one second probe. The probe won by
timeout, marked the scenario passed, and left the request alive inside
the cached web handler. Final disposeApps() then waited for those
requests forever, so any run that rebuilt the app (cold turbo cache)
never exited and CI cancelled the job at 15 minutes.
Add a scenario flag that keeps the missing-credentials check (the route
must still return 401) but skips the valid-credential probe for routes
whose valid requests intentionally block, and mark tui.control.next and
instance.reload with it.
onCreateMultiVersion was a 180-line orchestration method on the provider,
and the merge pushed AgentManagerProvider past its 1900-line arch cap.
The flow moves to provider-multi-version.ts next to provider-lifecycle.ts
and follows the same pattern: state comes from the ProjectContext, and a
MultiVersionHost (extending LifecycleHost with worktree discard, the
branch naming prompt, and error reporting) carries provider capabilities.
The flow is decomposed along its existing phase boundaries to satisfy the
complexity limit: createVersion (one worktree + session, sandbox gate,
exposure), reconcileSandbox (rollback on failure), and sendInitialPrompts
(Phase 2 fan-out). Behavior is unchanged; the sandbox ordering test now
asserts per-function wiring instead of cross-function source order.
* fix(ci): pass --auto to the docs-sync kilo runs and keep full stderr logs
Headless kilo run auto-rejects every permission ask it receives, and the
GitHub runner has no user config granting bash — so without --auto the
docs-sync bot's triage, edit and verify-fix calls were silently crippled
whenever the agent reached for a non-allowlisted shell command (CI run
30306629290: 9 rejections, all 11 edit batches failed, exit 0).
- Pass --auto immediately after "run" at all three call sites
(triage.mjs, edit.mjs, docs-sync.yml Fix verify failures step)
- runKilo now always writes the child's full stderr to
docs-sync-out/kilo-stderr-<label>.log, on success as well as failure —
the blindness that hid the defect
- selftest asserts --auto non-vacuously (region-scoped source match +
a stub invocation that records argv) and proves the stderr log is
written on both the failure and the summary-writing success path
* fix(cli): exit nonzero when a headless run auto-rejects or its session errors
Non-interactive kilo run reported success for runs that accomplished
nothing — a caller cannot distinguish success from a dead run, which is
why the docs-sync bot had to stop trusting exit codes entirely.
- Plain headless run (neither --auto nor --dangerously-skip-permissions)
in which the CLI auto-rejected at least one permission ask now exits
non-zero, even when the session still reaches idle afterwards, with
the diagnostic: run ended with an auto-rejected permission; pass
--auto for autonomous use. Deliberate contract change: any
auto-rejected ask means the run was crippled, not successful.
- A mid-stream session error now writes its diagnostic to stderr before
emitting the json error event, so the cause is visible under
--format json as well (the emit-first shape skipped the stderr write).
- The old exit-0 contract lock-in test is replaced: its llm.fail fixture
never published a consumable session.error, so it locked in a false
premise. New tests cover both scenarios in both output formats;
happy-path and --format json runs still exit 0 unchanged.
* fix(ci): redact secret env values from persisted kilo stderr logs
The full-stderr capture added for observability lands in uploaded CI
artifacts, which are raw files (GitHub masks secrets in log streams
only) on a public repo, and the runner env holds a long-lived
KILO_API_KEY. Redact exact values of KEY|TOKEN|SECRET-named env vars
(len >= 8) once at capture, so both the console tail and the artifact
file are safe. Adds the changeset for the headless exit-code contract
change.
* fix(ci): redact secrets from persisted kilo stdout and harden redaction
The docs-sync workflow uploads docs-sync-out/ as a public 14-day artifact,
and kilo stdout was persisted raw there in two more places: triage-raw-*.txt
and the edit-log.txt tee. Redact at capture in runKilo for stdout as already
done for stderr, and pipe the verify-fix step's kilo stdout through a new
line-wise redact-stream.mjs filter before tee.
Also harden redactEnvSecrets: widen the name pattern to
KEY|TOKEN|SECRET|CREDENTIAL|PASSWORD|ORG_ID|_PAT (KILO_ORG_ID is a repo
secret), replace longer values first so a short secret that prefixes a
longer one cannot leak the remainder, and document the exact-substring
limitation. Selftest gains cases 2e (prefix ordering), 2f (stdout capture),
2g (stream filter) and a non-vacuous exact-line assertion in 2d.
* fix(cli): correct the headless-exit changeset's json-format claim
The auto-reject path adds a new error event to the --format json stream;
only the existing event shapes are unchanged. Also state that the exit-1
rule covers a plain non-interactive --attach run that auto-rejects an ask.
* fix(ci): document --auto security trade-off and deferred hardening
Update comments in triage.mjs and edit.mjs to accurately describe the
security implications of --auto (unrestricted bash for an agent steered
by external PR content) and note that a scoped permission.bash map via
KILO_CONFIG_CONTENT is the intended hardening, deferred until required
shell patterns are stable.
* fix(ci): raise docs-sync budgets so the backlog can actually drain
--auto fixes the batches the bot attempted; it does not fix the ones it
never started. In run 30306629290 (254 PRs collected, 51 docs-worthy),
the wall-clock budgets deferred 54 PRs untriaged and 31 unedited without
an attempt — 45 of the 60 pending rows on the rolling PR. Triage got 8 of
11 chunks in 35 min; edit got 4 of 11 batches in 50 min.
Both are ceilings, not costs. A caught-up run needs ~2 chunks and ~1
batch and finishes in ~25 min, so raising them spends nothing on a normal
day and drains the backlog on a bad one. 90/120 covers 20 chunks and 14
batches — 500 triaged and 70 edited PRs against a ~5 docs-worthy/day
inflow — inside a 240-minute job timeout.
Also strip ANSI CSI sequences in tailText, the shared path both triage
and edit route their pending causes through. kilo renders its TUI to
stderr, so every "Why" cell on the rolling PR currently reads
"^[[0m→ ^[[0mRead packages/..." instead of the diagnostic. The persisted
docs-sync-out/kilo-stderr-*.log stays raw as the debugging record.
selftest case 2h asserts the pending reason is escape-free and still
carries the diagnostic text; case 2i asserts each budget fits at least
two units and the job timeout outlasts both, so a future edit cannot
silently restore a budget too small to run anything. Both shown failing
on the unmodified code first.
* fix(ci): keep the docs-sync rebuild authoritative in the fix step
The "Fix verify failures" step runs under `set -o pipefail` and the
default `bash -e`. Once the CLI half of this PR ships, `kilo run` exits 1
on a mid-stream session error, which aborts the block before the rebuild
runs: verify2.log is never written and `Re-verify status` reports
VERIFIED=false even when the docs build fine. A transient provider error
would flip every rolling docs PR to "Verification: failing".
The agent's exit code was never the signal for this step — the rebuild
is. Guard the pipeline with `|| echo ::warning::` so a nonzero kilo run
is surfaced but the rebuild still decides the outcome.
Extends selftest case 2b (which already parses this step) rather than
adding a case: the guard must appear between the pipeline's tee and the
rebuild, so a comment elsewhere in the block cannot satisfy it. Shown
failing with the guard removed.
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
A prompt sent while a session is running queues behind the active turn,
which breaks out of its loop after the current LLM step drains. That
handoff was recorded with close reason "interrupted", so the webview
rendered the yellow "Turn interrupted." card during the brief idle
window before the queued turn started.
The handoff now closes with a dedicated "superseded" reason instead.
Clients extend their close-reason unions and the webview suppresses the
terminal warning card for superseded turns; memory digests still treat
the cut-short turn as interrupted, and real user interruptions are
unchanged.
Bruno Agatao