* feat: add AI image generation tool
Port the legacy generate_image tool to the opencode-based CLI as a
Kilo-owned tool gated by experimental.image_generation config flag.
- New generate_image tool with prompt/path/image/model params
- Routes through Kilo Gateway (zero-config) or BYO OpenRouter key
- Supports text-to-image generation and image editing
- Dynamic model discovery via GET /kilo/models/images endpoint
- VS Code settings toggle + live model dropdown in Experimental tab
- Writes image to disk and returns inline FilePart attachment
- Fallback model catalog for offline resilience
* refactor: change default image model to openrouter/auto
* fix: address bot review feedback
- Remove unused fetchKiloImageModels import in tool
- Normalize jpg→jpeg MIME in parser, input image, and attachment
- Replace mismatched extensions in ensureExtension (not just append)
- Add assertExternalDirectoryEffect for output path traversal guard
- Map unauthorized errors to 401 (not 400) in image models handler
- Keep last known model list on fetch failure (don't overwrite with empty)
- Fix tool description (remove false web search claim, fix grammar)
- Remove duplicated provider resolver tests
* fix: add retry for image models request to handle backend startup race
* fix(image-generation): address kilo bot review comments
- ensureExtension replaces mismatched image extensions instead of
appending (photo.jpg + PNG -> photo.png, not photo.jpg.png)
- Gateway /models/images normalizes errors to 400/401 matching every
other gateway route (was leaking undeclared upstream statuses)
- Add 401 response to openapi.json + SDK types for /kilo/models/images
to match the gateway's errors(400, 401) declaration
* fix(gateway): align /models/images error handling with other gateway routes
* refactor: switch image generation to effect HttpClient
* test: cover kilo models images endpoint in httpapi exercise scenarios
* Exclude POST-only and parameterized API endpoints from link checker
* Add ImageModelsProvider to agent manager context tree
* chore(deps): bump @openrouter/ai-sdk-provider to 2.10.0
Switches imageModel() to OpenRouter's POST /api/v1/images endpoint for
proper image usage/billing and image-specific params.
* fix: address image generation PR review feedback
- revert @openrouter/ai-sdk-provider 2.9.0->2.10.0 bump (image tool uses raw HTTP, not the SDK)
- translate image generation settings strings across all locales
- use central KILO_OPENROUTER_BASE instead of hardcoded URL fallback
- remove completed plan file
* chore: refresh source-links.md after URL refactor
* feat(opencode): experimental SWE-Pruner for task-aware tool output pruning
Adds an experimental.swe_pruner config flag (default off). When enabled,
the read and grep tools advertise an optional context_focus_question
parameter; when the agent provides it, large outputs are skimmed by the
small model down to the lines relevant to the question, with omitted
sections marked inline. Failures fall back to the full output.
Based on SWE-Pruner (arXiv:2601.16746).
* chore: regenerate source-links for swe-pruner arxiv reference
* fix(opencode): address swe-pruner review suggestions
Harden the skimmer instruction against prompt injection from untrusted
tool output, and document that pruning runs before the tool.execute.after
hook so plugins observe the model-facing output.
* feat(ui): surface SWE-Pruner activity on read/grep tool rows
The read renderer hides tool output entirely, so pruning was invisible in
the webview even though the model received the pruned output. Show a
'SWE-Pruner · kept/total' row driven by the swePruner tool metadata.
* chore: retrigger CI (flaky windows/jetbrains tests, review service delivery error)
* feat(opencode): configurable SWE-Pruner skimming model
Adds experimental.swe_pruner_model (provider/model format) with a model
selector in the VS Code Experimental tab, shown when SWE-Pruner is
enabled. Falls back to the configured small model when unset or when the
configured model is unavailable.
* fix(ui): localize the SWE-Pruner pruning indicator
Replace the hardcoded label with a ui.tool.swePruned i18n key
(interpolated kept/total) added to all 20 shared UI locales.
* chore: retrigger CI (windows bun install network timeout on tree-sitter-powershell)
---------
Co-authored-by: marius-kilocode <marius@kilocode.ai>
Move the leftover-.opencode-directory detection off the always-on config
warning and into the cloud notifications list (client.kilo.notifications),
so it flows through each client's per-id dismissal: dismiss it once and it
won't return unless the directory is still present.
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
A plain Error thrown when no changes are found became an untyped
defect through EffectBridge.fromPromise, which the error middleware
masked as a generic 500 "Unexpected server error". Declare a
CommitMessageNoChangesError (Schema.ErrorClass, httpApiStatus 422)
on the endpoint and translate the domain NoChangesError defect into
that typed failure, so the real message surfaces. The extension now
shows it directly instead of prepending a redundant prefix.
Kilo no longer falls back to opencode configuration stored in `.opencode`
directories. This change adds detection for both global and project-level
opencode configuration directories and issues a warning to guide users
on how to migrate their settings to the new Kilo configuration paths.
- Implement `KilocodeConfig.detectOpencodeConfig` to identify legacy
config locations.
- Add warning messages to the CLI configuration loading process.
- Update documentation to include migration instructions.
- Add tests to verify detection of global and project-level opencode
configs.
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
* feat(commit-message): add language parameter to commit message generation
Add support for generating commit messages in the user's selected UI language.
The language parameter flows through the entire stack: VSCode extension passes
the selected locale, the HTTP API accepts the new field, and the generation
service appends language instructions to the system prompt for non-English
locales.
- Update CommitMessageRequest types to include optional language field
- Modify VSCode service to pass selected locale to the API
- Append language requirements to system prompt when language is not English
- Update OpenAPI specification and regenerate SDK types
- Add test coverage for language instruction generation
* feat(commit-message): add configurable language setting for AI-generated commit messages
Add a new `kilo-code.new.languageCommitMessage` VS Code setting that allows
users to choose a specific language for AI-generated commit messages,
independent of the UI language. When set to "sync" (default), the commit
message language follows the Kilo Code UI language.
- Add language selector dropdown to CommitMessageTab settings UI
- Add getCommitMessageLanguage() helper in i18n service
- Pass languageCommitMessage setting through KiloProvider to webview
- Add translation strings for all 20 supported locales
* refactor(locale): standardize commit message terminology across locale files
Replace literal translations of "commit" with the loanword form in Brazilian
Portuguese and Spanish locale dictionaries, correct a Korean typo (커AI → 커밋),
translate an untranslated English label in Norwegian, and align terminology with
conventional usage across all four affected language packs.
* style(i18n): fix prettier formatting on commit-message language strings
---------
Co-authored-by: marius-kilocode <marius@kilocode.ai>
Widen the Additional Writable Paths input in the Sandboxing settings tab
so long filesystem paths are readable while typing, reusing the existing
wide-input variant without affecting the network toggle row.
Add tests for the sandbox_writable_paths behavior: real sandbox
enforcement that configured extra paths become writable while unlisted
paths and .git stay denied, and a config-scope test confirming the
setting is honored from global config only and dropped from project
config.
The coverage mode requires every documented endpoint to have a
scenario. Without this, test:httpapi fails with a missing scenario
for the new /instance/reload route.
- Block reload for retry and offline session states, not just busy
(hasActiveSession rejects any non-idle state)
- Close TOCTOU race by calling store.reload inline instead of deferring
to a pre-response handler, so the busy check and reload run in the
same effect
- Avoid double-firing reloadAfterAuthChange: only call it eagerly for
worktree sessions where the SSE directory check won't match; for the
workspace root the existing SSE handler already fires it
- Replace err: any with unknown + narrowing
- Add in-flight guard to the CLI /reload plugin to prevent overlapping
reloads from rapid double-invocation
- Remove the TaskHeader reload button (redundant with /reload slash
command, avoids chat visual regression baseline churn)
Reboots the per-directory instance, reloading config, skills, agents,
commands, and MCP prompts changed on disk without restarting the
server. Sessions and history are preserved; only the per-directory
instance caches are torn down and rebuilt.
Server: POST /instance/reload wraps the existing atomic
InstanceStore.reload path (the same one project.git.init uses). The
rebuild completes before the 200 response, so clients can refetch with
no race. Returns 409 ConflictError while a session is actively
running. Emits the existing server.instance.disposed SSE event, which
the TUI and extension already use to auto-refetch.
CLI: /reload palette command calls the endpoint; the TUI already
bootstraps on server.instance.disposed.
Extension: /reload slash command, a reload button in the task header
and settings panel, and a Kilo Code: Reload Config and Skills command
palette entry. The handler clears the command cache and reuses
reloadAfterAuthChange to re-fetch config, providers, agents, skills,
and commands. Reload targets the current session's directory so Agent
Manager worktree sessions reload their own worktree instance rather
than the workspace root.
SDK: regenerate so client.instance.reload is available to external
integrations.
* feat(memory): opt-in project memory — capture, recall, CLI + TUI integration
Add project memory: the standalone @kilocode/kilo-memory effect layer plus the
opencode CLI/server/TUI integration. Memory is disabled by default, so it is a
no-op until enabled (no behavior change when off).
Capture (turn-close consolidation): per-op parse salvage, secret redaction that
skips the offending op instead of aborting the batch, supersede-only auto-updates
(never model-driven deletes), correction-aware echo handling, non-LLM fallback
digests on interrupted/error turns, a shared interval throttle with idle-flush.
Recall + injection: keyword tokenizer with camelCase/compound splitting, light
stemming, and an English-first stopword filter (Unicode-aware; non-English falls
back to plain token-overlap), a live relevance floor, a budget-reserved startup
index, a session-digest catalog, and per-session prompt-cache pinning of the
injected memory block.
Surfaces: kilo_memory_save / kilo_memory_recall tools, the memory HTTP API
(contract schemas live in the package), and a status-focused TUI sidebar showing
auto-save, loaded context, and active recall, plus the /memory dialog.
* fix(memory): address PR review feedback
- C1: bump @kilocode/kilo-memory in the changeset
- C2: redact secrets before they hit the audit log (skip + salvage paths);
redact before truncating in salvageTyped so a secret straddling the
500-char cap can't leak an unmatched fragment; opText -> salvageText
- C3: de-abbreviate savedOperations, "changes" wording, ops.ts -> operations.ts
- C4: log.warn on the remaining silent-catch fallbacks (turn diff, memory
context injection, tool-visibility check)
- C5: relocate memory storage from ~/.kilo to Global.Path.data, delete the
now-dead needsDependencyInstall guard, add /memory status (root path) and
/memory edit ($VISUAL/$EDITOR + auto-rebuild)
- C6: replace the hardcoded English stopword list with corpus-derived
ubiquitous-term filtering (df across the user's own entries) and the
English suffix stemmer with suffix-tolerant term matching, so recall
noise-filtering works in any language
- C8: delete the CORRECTION_INTENT English regex; echo turns now run typed
capture (digest stays echo-gated), bounded by the interval throttle, with
the typed prompt as the language-agnostic content filter
- C9: exclude generated paths (dist/build/coverage/*.gen.*/*.map/snapshots)
from the durable-diff churn fallback so generated churn can't burn a
consolidation call
- C11: fix duplicated assert in httpapi-memory test; assert the error body
- kilo-code-bot batch: clause-boundary regex fix, byte-safe catalog
truncation, max-length guards on remember/correct/forget payloads (text,
query, key, sessionID), trim consistency in reconcile, param-shadowing
rename, missing doc entry for kilo_memory_recall, dead-code removal,
dialog UI fixes, memoryEnabledCache eviction bound, dedicated Configure
schema, recall permission renderer, covered-session pointer cap, redact
chat transcript before the consolidation model call, split configProtected
metadata from disableAlways so memory-save prompts don't show config-file
copy, drop unused MemoryService.layer provide from tool registry
- redact colon-separated low-entropy secrets too (password: hunterx),
accepting the prose false-positive tradeoff (secret: enabled) in favor of
not missing a real secret
- rename lastConsolidatedAt -> lastTypedConsolidationAt to make its narrow
scope (typed-consolidation throttle clock) explicit; regen openapi/SDK
- drop now-dead home/config fields from MemoryPaths.Host after the data-dir
relocation; add Process.splitCommand for quoted $EDITOR/$VISUAL paths with
spaces, used by /memory edit and the pre-existing Editor.open utility
* refactor(memory): shared client helpers, capture hardening, /memory UX rework
- extract client-side derivations into kilo-memory so both frontends share
one implementation: MemoryDecisions.summarize (decision-log summary),
MemoryAutosaveStatus.summarize (autosave-status semantics), and
MemoryMarkerMeta (marker wire contract encode/decode)
- match exact-key upserts via the canonical stored id (slugged key,
normalized section) so a re-emitted spaced/uppercase key updates the
entry instead of falling to fuzzy dedupe
- salvageTyped throws on valid JSON without an operations array so the
caller's fallback path records a parse error instead of a silent
zero-op success
- rename memory tool metadata files -> sources (stripPartMetadata rewrites
tool-part metadata.files assuming apply_patch records, mangling string[])
- read state instead of status for tool enabled checks; dedupe TUI helpers
(errorMessage, shared route(), Locale.number, relativeTime)
- /memory UX: bare /memory opens a help modal driven by a structured
command catalog in kilo-memory; /memory on|off become the canonical
toggle verbs (enable/disable kept as quiet aliases); /memory status opens
a clean overview dialog (root path, autosave, startup context, source
counts, index size) instead of a toast; /memory show is the single full
audit view (inspect removed)
* feat(cli): remote model catalog and WebSocket reconnection fixes
* fix(cli): preserve provider default semantics under truncation and deflake reconnect test
* fix(cli): omit provider default when per-provider truncation removes preferred model
* refactor(cli): simplify remote model catalog by removing size limits
* refactor(cli): strip remote model catalog to sanitize-and-shape only
* fix(cli): cap remote model catalog at MAX_MODELS
* fix(cli): preserve model metadata and enforce remote catalog limits
* fix(cli): omit currentModel and defaultModel when truncation drops them
* fix(cli): keep stable connection identity across reconnects
* feat(cli): include protocol version in remote session heartbeat
Agent prompts substitute with missing:"empty", which swallowed every file read error — including a deliberate out-of-scope scope block — so an escaping {file:} was silently emptied and never warned, contradicting the agent.ts catch narrative. Tag security blocks as ConfigVariableGuard.BlockedError (out-of-scope, fd swap, /proc) and, in substitute(), always reject those regardless of missing:"empty"; genuine missing/IO errors are still emptied. Now an out-of-scope {file:} in an agent prompt rejects, hits the agent catch, and records a warning. Adds guard/substitute tests for the block-under-missing:empty, missing-is-emptied, and BlockedError classification cases.
In-root absolute paths are intentionally allowed; only references that leave the root (absolute paths outside it, ../ traversal, symlinks) are rejected. Fix the docs wording and add a regression test for the in-root absolute case.
KilocodeConfigOverlay.load() propagated InvalidError from untrusted {env:}/out-of-scope {file:} substitutions through Promise.all, breaking the whole /config/overlay instead of skipping the offending file. Skip failed files (log + return {}) so the settings overlay still shows remaining config, matching the main config loader's degrade-gracefully behavior.
Move the vim modal editing engine and prompt integration out of shared
upstream files and into src/kilocode/ mirrors per the Fork Isolation Rule:
- src/kilocode/cli/cmd/tui/component/prompt/vim.ts (engine, moved)
- src/kilocode/cli/cmd/tui/component/prompt/index.tsx (new mirror with
useVim, VimModeIndicator, vimToggleCommand)
- test/kilocode/cli/cmd/tui/prompt/vim.test.ts (moved)
The shared prompt/index.tsx now calls into the mirror behind minimal
kilocode_change markers instead of inlining ~200 lines of vim logic.
plan_exit fell back to Session.plan()'s generated slug path whenever
the model omitted an explicit path, which no longer matched the
agent-chosen filename plan mode now instructs. That mismatch caused
both the wrong filename shown after "Plan is ready" and a silently
missing implement-next-session prompt (issue #11859).
plan_exit and the follow-up flow now verify the plan file exists,
recovering it via a session-timestamp glob or the plan agent's last
markdown write when the exact path is missing, and fail loudly with
actionable guidance when nothing was written.
The failure message also names an explicit path parameter that got
rejected (outside the project, or a directory), instead of silently
substituting a freshly-guessed filename that never matches what the
model actually wrote. This only affects wording of the final error:
Session.plan() and locate()'s recovery tiers still run first, so a
rejected path that's actually the canonical non-git plans dir (which
sits outside the project boundary by design) still recovers via the
timestamp glob rather than failing outright.
The CLI /sandbox toggle was session-scoped: each new session reset to
the static config default (or secure()-forced ON in authless mode),
while the VS Code extension's sandbox button persisted the last choice.
Add a per-directory persisted preference (SandboxPreference) that new
sessions resolve after create-time metadata and before the config
default, so /sandbox now remembers the last toggled state per project.
secure()-by-default still applies when neither an explicit choice nor
a preference exists. Add SandboxPreference.root to the sandbox
denyWrite list so a sandboxed process cannot plant a false preference
to disable confinement for later sessions.
Add regression coverage for capOutputTokens preferring the provider-reported
context size (image/vision input priced by the provider) and falling back to
the media-normalized floor when reported usage is smaller or absent.
marius-kilocode