- Adds 'new file' marker to check-forbidden-strings workflow
- Marks the SKIP_FILES addition in extract-source-links.ts
- Updates nvidia-headers test to assert the new kilo.ai/Kilo Code values
The forbidden-string list contains opencode.ai URLs as literal patterns
to ban; they aren't real source links and shouldn't show up in the
source-links manifest.
Adds commented-out entries for the URLs/strings we want to ban once the
underlying call sites are rebranded, and tells the upstream-merge agent
to flag new upstream-attribution leaks for inclusion in the list.
Replaces hardcoded opencode.ai/anomalyco URLs in production code paths:
LLM provider HTTP-Referer/X-Title attribution headers, the TUI error
dialog's bug-report URL, and the github-remote parser test fixtures.
Extends check-forbidden-strings with patterns for these leaks (with a
narrow allowlist for fork-lineage docs and upstream-merge tooling).
Replace the inline opncd.ai/s/ grep added to check-kilocode-change with a standalone script/check-forbidden-strings.ts. Wired into test-vscode.yml as a separate step alongside the existing marker check.
Avoids the ls-remote + merge-base --is-ancestor walk in last() for the
common case by reading the recorded tag from .opencode-version. merge.ts
writes the file as part of the pre-merge compat commit so future runs of
fix-kilocode-markers, reset-to-upstream, and find-reset-candidates can
resolve the base tag instantly. Seeded with v1.14.33 (PR #9978).
git rerere learns conflict resolutions from past upstream merges and
replays them on the next merge. When past resolutions used the buggy
mergeWithNewestVersions ordering, rerere auto-resolves package.json
files with stale content before transformConflictedPackageJson ever
gets a chance to run — so the fixed merge logic never reaches the
file.
Add reconcileAllPackageJson, which runs after every merge (clean,
auto-resolved, or partially conflicted) and rewrites every package.json
that the merge touched from the kilo branch's pre-merge HEAD and the
opencode compat branch using the same merge logic. Files that are
still conflicted are skipped so manual resolution isn't silently
overwritten.
This makes our merge logic the source of truth for package.json
content, regardless of what rerere or git's textual merge produced.
Seeding the result with theirs' keys and appending ours-only keys at the
end caused kilo-only deps (e.g. rotating-file-stream in packages/core)
to relocate from the middle of the deps block to the end during the
pre-merge transform. Git's textual 3-way merge then saw ours keeping
the line in place and theirs adding the same key elsewhere, producing
a duplicate JSON key in the merged file.
Iterate ours first so kilo-only deps stay in their original position,
then append any theirs-only keys at the end.
The transform that materialises the 'kilo compat for vX.Y.Z' commit during
an upstream merge takes upstream's package.json wholesale and re-applies a
hand-picked list of Kilo scripts. That list was incomplete: it only covered
`extension`, `changeset`, `changeset:version`, `test`, and `test:ci`, so
every merge silently dropped Kilo's `postinstall` tail (`&& bun run
script/setup-git.ts`) and the `dev-setup` root shortcut, and it never
pruned upstream-only scripts (`dev:desktop` / `dev:web` / `dev:console`)
or upstream-only catalog entries (`@sentry/solid`,
`@sentry/vite-plugin`) whose target packages Kilo doesn't ship.
- replace the per-script if-blocks with data-driven PRESERVE_SCRIPTS
- add DELETE_UPSTREAM_SCRIPTS for scripts that reference packages Kilo
doesn't ship
- add DELETE_UPSTREAM_CATALOG for catalog entries with zero Kilo consumers
- apply the same policy in both transformPackageJson (conflict path) and
transformAllPackageJson (pre-merge sweep path) — previously the
pre-merge sweep was missing `changeset` / `changeset:version`
preservation
- new tests covering preservation, deletion, opencode test scripts, and
the catalog pruning
Allow Azure provider connections to capture resource names or endpoint URLs so GPT-5 deployments can use the native Azure path instead of generic OpenAI-compatible setup.
Update `findLatestCompatCommit` to use semantic versioning when identifying the latest compatibility commit. This ensures the correct commit is selected even when upstream tags diverge or are not strictly linear.
- Add semver parsing and comparison utilities
- Implement `targetSemver` to resolve versions from tags or commit messages
- Filter and sort compatibility candidates by version relative to the target version
- Add test case for diverging upstream tags
Hardcodes the list of active and disabled workflows and fails CI when
.github/workflows/ drifts. Wired into check-opencode-annotations so we
don't add a new workflow file for this.
Add a new setup script to configure `merge.conflictStyle=zdiff3` locally
within the repository. This ensures that the common ancestor is visible
during merge conflicts, which is required for structural resolution by
`mergiraf` and simplifies manual conflict resolution.
The configuration is applied during `bun install` via the `postinstall`
hook and remains as a fallback for the upstream merge utilities.
Upstream opencode stamps its own version into shared files (the Zed extension toml + any package.json it bumps), which leaves the tree pointing at an upstream release tag that doesn't exist on Kilo's pipeline — Zed download URLs silently 404 as a result.
script/sync-versions.ts rewrites every top-level package.json version and the Zed extension toml (version + 5 download URLs) to a single target in one shot. Defaults to the root package.json version, accepts an explicit version argument, and skips packages/kilo-jetbrains/ which tracks its own cadence.
Documented in .kilo/command/upstream-manual-merge.md as a dedicated step-10 commit after 'resolve merge conflicts' so version churn stays out of the behavioural merge commit.
Fixes hang when running the finder from the repo root without a path
scope. Root cause: upstream-only packages (packages/console, packages/web,
packages/desktop, etc. in config.skipFiles) contain multi-megabyte
media assets that stall concurrent Bun `git show` subprocesses on the
pipe buffer.
Changes:
- Batch upstream blob sizes in one `git cat-file --batch-check`
subprocess before classifying anything. Files with missing upstream
land directly in `upstream-missing`; files > 256 KB land in the new
`too-large` bucket. Only sane-sized survivors get per-file `git show`.
- Filter out files matching the merge config's `keepOurs` and
`skipFiles` globs (.github workflows, translated READMEs, upstream-
only packages, etc.) — these are intentionally preserved or removed
in Kilo and would otherwise pollute the report and tempt incorrect
resets.
Full-repo dry-run now completes in ~2s.
Catriel Müller