* feat: daily docs-sync bot workflow (Kilo CLI)
Adds a scheduled workflow that keeps packages/kilo-docs in sync with PRs
merged to Kilo-Org/cloud and Kilo-Org/kilocode:
- watermark.mjs derives the processing window from the bot's own PR body
marker (self-healing, no external state; 72h fallback, 14d cap)
- collect.mjs queries merged PRs via the GitHub API and applies a
deterministic pre-filter (bots, chores, docs-only PRs)
- triage.mjs classifies PRs in chunks of 25 with kilo run; failed chunks
degrade to unclassified instead of failing the run
- edit.mjs updates docs in batches of 5 PRs with kilo run, bounded per
batch; failures surface as skipped entries in the PR body
- verify runs the kilo-docs build + test suite; one LLM fix pass on
failure; still-red becomes a draft PR
- upsert-pr.mjs maintains one rolling auto-docs PR (appends while open,
fresh branch after merge), with a 15-file draft cap and a
machine-readable processed-through watermark
Also adds docs-sync.yml to the workflow allowlist in
script/check-workflows.ts.
* fix: correct kilo run invocation and auth
- message positional must come before flags: --file is multi-value and
consumes a trailing message as a file path (File not found)
- authenticate via the existing KILO_API_KEY repo secret (the kilo
provider reads it natively); drop the DOCS_SYNC_KILO_CONFIG config
secret requirement
- fix default model IDs: gateway provider id is kilo/, not kilocode/
- include stderr tail in triage/edit failure logs
* fix: handle kilo run double-printed assistant output
kilo run prints the assistant message twice (streaming render + final
summary), so stdout can contain the same JSON array back-to-back. Parse
the largest valid trailing array instead of slicing first-to-last
bracket. Verified against real chunked triage output.
* fix: reviewer-pass robustness fixes
- edit.mjs: unambiguous summary file path in the batch prompt and a
fallback read when the agent drops the docs-sync-out/ prefix, so real
edits never report as skipped
- prepare-branch.mjs: use the open auto-docs PR's actual head.ref
instead of assuming docs/auto-sync
- upsert-pr.mjs: compute the 15-file draft cap on the cumulative PR
diff (origin/main...HEAD), not just the latest commit
* fix: address Kilobot review findings
Security:
- sanitize HTML-comment sequences out of agent-generated PR body values
so a crafted value cannot forge section markers or the watermark
- draft any PR whose diff touches non-content files in packages/kilo-docs
(outside pages/ and lib/nav/) — build-executable changes force human
review before merge
- on merge conflict, keep the conflicted rolling branch untouched
(preserving human commits) and continue on a fresh dated branch that
links the old PR
Resilience:
- retry GitHub API calls on network errors and 5xx, not just 403
rate limits
- isolate per-PR collect failures instead of aborting the run
- trust watermark markers only on bot-authored PRs and clamp future
dates loudly
- validate chunk triage entries belong to their chunk before the shared
dedupe
- use changed_files for files_total and skip docs-only classification
on truncated (300+) file lists
- pipe stderr in the edit pass so failure warnings carry the real CLI
error
* fix: address second Kilobot review round
- escape pipe characters in changeRow actions (same as skippedRow)
- sanitize agent-chosen file paths before they land in draftReasons
and the PR body (residual marker-forgery path via filenames)
- log expected fetch misses in prepare-branch instead of silent catches
* feat: keep bot-authored PRs in the docs-sync digest
Release and dependency bots ship user-facing changes (e.g. JetBrains
release PRs from kilo-maintainer[bot]). The auto-docs label check and
docs-only path filter remain as the loop guards.
Two regressions in the plan handoff flow:
Choosing "Start new session" after a plan created the session in the
background but left the UI on the completed plan. Since #10466 the
sidebar only activates sessionCreated messages that match a pending
draft tab, and followup sessions carry no draftID. registerSession now
takes an activate flag, adoptPendingFollowup passes it, and the webview
opens and focuses the tab when set.
Replying to a recovered question took two submits. The first reply hit
the recorded stale directory, got a 404, and the handler redrew the
question instead of retrying. Recovery now rediscovers the directory
and retries the reply or reject there once, and only marks the question
stale when a complete scan confirms it is gone.
The https://fireworks.ai/pricing marketing page intermittently returns
500 Internal Server Error to automated link checkers (bot detection),
causing the lychee CI link-check job to fail.
Replace it with https://docs.fireworks.ai/serverless/pricing, the stable
per-model pricing page that the Fireworks marketing page itself links to
as the authoritative source for current model pricing. This URL returns
200 to link checkers and contains the actual per-token pricing details.
* refactor(cli): run remote sessions in one process with safe per-session exit
Consolidate remote session handling into a single CLI process instead of
spawning one process per remote-created session (addresses the PR review):
- restore in-process create_session (accepts an absent sessionId and targets
the connection directory); remove the session spawner, the
KILO_REMOTE_ATTACH_SESSION attach-on-boot path, the child-advertisement gate,
and their tests
- retain instance advertisement and fire one immediate out-of-band heartbeat on
(re)connect when advertising, so a headless `kilo remote` host is discoverable
without delay
Make /exit (wire command exit_cli, unchanged for compatibility) detach only the
target session instead of terminating the CLI:
- AttachedState.detach with a presence-suppression tombstone; detach also clears
the target's SessionStatus so the negative-containment heartbeat fence resolves
deterministically for busy/retry/offline sessions
- exit_cli handler verifies ownership, cancels the active prompt, detaches and
awaits the detach heartbeat, then ACKs; the interactive RemoteExit callback is
invoked only after the ACK when the last owned session exits; a headless
`kilo remote` host stays alive and advertising at zero sessions
- add an optional canExitSession boolean to the list_commands v1 catalog
(always true, independent of exitAvailable) so clients can detect safe
session-exit semantics
History and stored sessions are preserved on exit.
* fix(cli): break module-load cycle in remote session prompt-cancel
The K1 in-process exit_cli seam added a static `import { SessionPrompt }`
to kilo-sessions.ts. @/session/prompt evaluates KiloSessionPrompt at module
load, so the new static edge raced that init and left the namespace in TDZ,
crashing unrelated test files with 'undefined is not an object (evaluating
KiloSessionPrompt.shouldAskPlanFollowup)'. Defer to a dynamic import at the
single call site, mirroring remote-command.ts.
* fix(cli): correct AttachedState announce/detach concurrency and rollback
Address review findings on the shared-process session lifecycle:
- announce/detach no longer join the OPPOSITE in-flight operation. Joining
detach's negative-containment fence made announce resolve success for a
detached id (and vice versa: detach joined announce and resolved success
while still attached, which exit_cli treats as license to ACK/close). Each
path now joins only a same-kind in-flight op and, when the opposite op is
in flight, awaits it to settle and then performs the real work.
- Failed-detach rollback now releases the suppression tombstone, so a
still-attached session is not dropped by the next setPresence (the tombstone
loop would otherwise remove the still-present id and never clear).
- Both catch/rollback branches now honor the lifecycle generation guard
(mirroring the success path); a stale in-flight op that rejects after
reset() no longer mutates the new lifecycle's presence/pending/suppressed
sets (reset clears the same Set instances).
Adds regression tests for each fix, plus AC6f covering the remote-ws
detachSessionId negative-containment waiter.
Each prose markdown pane kept a viewport ChangeListener for its whole life, so every scroll tick fired a synthetic mouse move (native pointer query + event dispatch) on every prose block — cost that scaled with transcript size. Subscribe to viewport scrolls only while the pointer is over the pane, making per-scroll work O(1) while preserving hovered-link and cursor refresh.
- SessionLayout: forget a turn's cached height on content change so a
settled TurnView (its own validate root) that re-validates independently
cannot return a stale measurement from the layout cache
- ToolSupport: remove dead setLinkText; restore patchMarkdown raw-text
fallback for metadata-only patches (pure rename/mode change)
- EditToolView: drop redundant popup update() already done by mount()
- tests: make header-stripping assertions non-vacuous, cover the
metadata-only patch fallback and SessionLayout.forget
- HeaderPopup.contentWidth: measure leaf JComponents by preferred width
instead of the unreachable is-JComponent branch (Container matched first).
- PatchBody.applyStyle: report change when the per-file diff panes restyle,
so a font/theme change relayouts the multi-file patch view.
- MdDiffHighlight: only treat +++/--- as file headers when followed by a
space or end of line, so content lines like "++x;" stay colored as inserts.
- EditToolView.sync: compute editPath(item) once.
- Strengthen multi-file patch badge assertion and add MdDiffHighlight tests.
Cache width-aware preferred-size measurement in SessionLayout (reused while
a child stays valid at the same width), so streaming and scrolling no longer
re-measure the whole transcript on every event. Mark settled (non-streaming)
turns as Swing validate roots behind the kilo.session.validateRoots flag to
confine repaint churn, and skip redundant panel refreshes on no-op content
events. Narrow the follow-scroll validate pass to the transcript subtree.
Adds SessionLayout cache tests, validate-root/settled behavior + width
propagation tests, and a panel-level streaming stress/teardown test.
kilo-maintainer[bot]