* feat(session-export): scaffold module with config constants
* feat(session-export): add zstd compression wrapper
* feat(session-export): event and envelope type definitions
* feat(session-export): eligibility check with kill-switch
* feat(session-export): org signal collector with auth resolver
* feat(session-export): worker SQLite schema and storage helpers
* feat(session-export): content-addressed chunker with zstd dedup
* feat(session-export): client-side light scrubber
* feat(session-export): IPC contract and inbox with back-pressure
* feat(session-export): persist scrubbed events with chunked payloads
* feat(session-export): worker entry point with inbox drain loop
* feat(session-export): main-thread capture module
* feat(session-export): workspace baseline and delta fibers
* feat(session-export): sync subscriber and tool io chunking
* feat(session-export): bootstrap wiring and compaction hook
* feat(session-export): wire capture hooks into sessions
* feat(session-export): uploader and buffer cap
* chore(session-export): annotate shared session hooks
* changeset(session-export): add release note
* fix(session-export): keep bootstrap non-blocking without instance context
* feat(session-export): respawn worker after failures
* test(session-export): add performance budget assertions
* test(session-export): add worker end-to-end smoke test
* fix(session-export): strip identity and high-risk baseline paths
* test(session-export): gate perf assertions for stable sweeps
* fix(session-export): bundle worker in single-file builds
* fix(session-export): make capture envelopes cloneable
* fix(session-export): drain worker on CLI shutdown
* feat(session-export): capture workspace baseline and deltas
* fix(session-export): preserve request metadata
* test(session-export): cover request metadata capture
* feat(cli): send indexed session export batches
* feat(cli): authorize session export uploads
* fix(cli): flush session export shutdown uploads
* feat(cli): optimize session export replay payloads
* fix(cli): include session export surface metadata
* fix(session-export): decrement chunk refs after upload
decRefChunks was never called, so chunk ref_count stayed at 1 (or
higher with dedup) and DELETE FROM chunk WHERE ref_count <= 0 never
matched. Chunks accumulated in the local SQLite buffer until the 50 GB
cap. Call decRefChunks alongside markUploaded so deleteUploaded can
reclaim the rows.
* fix(session-export): add periodic uploader flush timer
flushIntervalMs and retryBackoffMaxMs were both defined in config and
neither was referenced anywhere; scheduleFlush only ran on inbound
events or reconnect. After a 5xx or network failure the row was backed
off for 1 s, but if no further event arrived the retry never fired and
the events stranded until the CLI restarted. Drive a periodic flush
from a setInterval, unref the handle so it doesn't pin the process, and
clear it from a new dispose() hook the worker calls on shutdown.
* fix(session-export): stop emitting absolute workspace root in baseline
CaptureMetadata.root was the literal absolute filesystem path
(/Users/<name>/Projects/<repo>), shipped in every
workspace_baseline_completed event and not stripped by handlers'
identity filter. The field was set but never read anywhere downstream
— file paths in the baseline are already relative, so the root added
no replay signal. Remove the field outright.
* fix(session-export): cap pendingEvents result set
The SELECT had no LIMIT clause, so under a backlog (network outage,
crashed receiver) it would materialize the full pending table into a
JavaScript array before the byte-limit truncation applied. With a
50 GB buffer cap that is hundreds of MB of heap inside the worker per
drain. Add LIMIT 500 — the drain loop already re-queries until empty,
so no events are missed.
* fix(session-export): exponential retry backoff up to retryBackoffMaxMs
Both the 5xx and network-error branches always retried after the floor
delay regardless of how many attempts had already failed, and
retryBackoffMaxMs was unreferenced. During a sustained outage every
session re-tried at roughly 1 Hz against the dead receiver. Surface
upload_attempts on EventRow and compute the next delay as
min * 2^attempts capped at max.
* fix(session-export): evict superseded workspace snapshots on remember
createWorkspaceProvider retained every captured snapshot — in-memory
and inside the persisted state file — even after the session moved on
to a newer one. For a 1k-file repo over a 100-turn session that is
~2 GB of unreachable heap plus a state file that grows monotonically.
Drop the previous snapshot for the session on remember() when no other
session still references it.
* fix(session-export): anchor aws_secret_key scrubber to key name
The bare 40-char base64 pattern matched every 40-character hex string,
including all git commit SHAs. Tool outputs, diffs, and conversation
messages were silently rewritten as <<REDACTED:aws_secret_key>>,
destroying lineage information in training data. Require the key name
context — naked secrets in unstructured text are rare and the .env /
.aws/credentials high-risk path strip already covers the common case.
* fix(session-export): preserve root linkage in SyncSubscriber events
SyncSubscriber hardcoded rootSessionId = sessionId on every tool,
permission, and feedback event, so sub-agent sessions lost their root
linkage and a future training pipeline could not reconstruct the
agent topology from these side-channel events. Expose the rootSessionId
mapping from Capture and plumb it through the same pattern as
getTurnId.
* fix(session-export): atomic chunk GC after upload
markUploaded + decRefChunks + deleteUploaded were three separate SQL
statements; a crash between markUploaded and decRefChunks would leave
events flagged uploaded (never retried) and chunks with stale
ref_count (never reclaimed by deleteUploaded). Bundle the three calls
into a single transactional commitUploaded helper so either all three
land or none of them do.
* fix(session-export): wait on transient sqlite locks
* fix(session-export): snapshot current workspace directory
* fix(cli): preserve Kilo model export metadata
* fix(cli): send anon id for session export
* fix(cli): fallback to telemetry anon id
* chore(cli): annotate session export config test
* chore: remove session export docs
* fix(cli): harden session export uploads
* fix(cli): preserve stream lifecycle for session export
* fix(kilo-docs): exclude session export ingest link
* fix(cli): restrict session export workspace sync to git repos
* chore: remove session export changeset
* fix(cli): tighten session export payload types
* fix(cli): type session export model payloads
* fix(cli): simplify session export cleanup
* fix(cli): avoid session export shutdown race
* refactor(cli): use drizzle for session export storage
* fix(cli): finalize session export sqlite statements
* fix(cli): link compaction exports to root sessions
* fix(cli): stop exporting raw stream parts
* fix(cli): prune stale workspace snapshots
* refactor(cli): clarify chunk ref counting
* test(cli): clarify dropped upload assertions
* ci: avoid visual path filter action failure
* fix(cli): preserve in-flight workspace snapshots
* fix(cli): stop uploading baseline start events
* fix(cli): trim redundant export metadata
* fix(cli): trim workspace export bookkeeping
* fix(cli): fold terminal outcome into tool exports
* fix(cli): dedupe request context in export batches
* fix(cli): normalize compaction export payloads
* fix(cli): avoid duplicate tool result exports
* test(cli): align session export expectations
* fix(cli): run secretlint during session export scrubbing
* fix(cli): keep retried export batches contiguous
* fix(cli): include agent info in session exports
* fix(cli): flush pending session exports on serve startup
* fix(cli): drop exports when scrubbing fails
* fix(cli): narrow secretlint value extraction
* fix(cli): limit exported agent info
* test(cli): remove brittle agent export source assertion
* fix(cli): ignore corrupt session export workspace state
* fix(cli): keep session export close best effort
* fix(cli): avoid following session export symlinks
* fix(cli): preserve session export chunk ref counts
* fix(cli): retry transient session export uploads
* fix(cli): validate session export ingest endpoint
* fix(cli): tolerate missing export token details
* fix(cli): fail closed on session export org lookup
* fix(cli): decode session export permission replies
* fix(cli): finalize session export on stream close
* fix(cli): bound session export baseline timeout
* fix(cli): avoid persisting workspace file contents
* fix(cli): bound workspace snapshot capture
* fix(cli): validate session export worker messages
* fix(cli): revoke stale session export eligibility
* fix(cli): scope session export workspaces
* fix(cli): extend session export shutdown flush
* fix(cli): infer free Kilo models for export
* fix(cli): avoid duplicate chunk refs
* fix(cli): throttle session export uploads
* fix(cli): harden session export capture
* feat: disclose free model data collection (#10767)
* feat: disclose free model data collection
* chore(cli): document free model footer sorting
* fix(vscode): add free model data translations
* fix: simplify free model data label
* fix: simplify data collection badges
* fix: remove duplicate model info disclosure
* fix: restore composer data tooltip
* fix: align jetbrains data collection indicator
* fix: align free model data indicators
* fix(vscode): show data collection in model preview
* fix: limit data indicators to kilo gateway
* test(cli): relax prompt cancel timeout
* test(cli): annotate prompt cancel timeout
* test(cli): classify prompt queue runtime test
* fix(cli): defer session export startup
* refactor(opencode): remove raw LLM interface in favor of stream-based text helper
Introduce KiloLLM.text() to consume Effect streams and extract text
while propagating error/abort events. Replace all usages of the removed
LLM.raw() method and the legacy LLM.stream() async wrapper with
dedicated runtime helpers (CommitMessageRuntime.generate,
PlanFollowupRuntime.handover) that leverage the new stream-based
approach.
- Add KiloLLM.text() stream combinator in kilocode/session/llm.ts
- Remove Interface.raw and the exported LLM.stream() async function
- Refactor commit-message generation to use CommitMessageRuntime
- Refactor plan-followup handover to use PlanFollowupRuntime.handover
- Update all test LLM mocks to remove raw() stubs
- Add unit tests for KiloLLM.text() covering text joining, error
propagation, and abort handling
* feat(skill): migrate Skill module to Effect service pattern and remove legacy promise wrappers
Remove the makeRuntime-based promise helpers (Skill.all, Skill.get,
Skill.dirs) from the skill module and convert the builtin-skills test
suite to use Effect generators with the testEffect harness.
- Delete legacy runPromise wrappers from packages/opencode/src/skill/index.ts
- Rewrite builtin-skills.test.ts to use testEffect and Effect.gen
- Replace WithInstance.provide/tmpdir with TestInstance yield pattern
- Use Skill.Service directly within Effect generators for all assertions
* refactor(session-status): drop makeRuntime promise helpers and wire Service through Effect context
Replace the standalone `SessionStatus.list`, `.get`, `.set` promise
wrappers with direct `SessionStatus.Service` usage via Effect generators
and `AppRuntime.runPromise` at Kilo callsites that remain imperative.
- Remove makeRuntime-based exports from session/status.ts
- Update kilo-sessions.ts and plan-followup.ts to use AppRuntime.runPromise
with SessionStatus.Service
- Thread SessionStatus.Service as a dependency through SuggestTool and
ToolRegistry layers
- Replace spy-based mocks in suggestion tool tests with an in-memory
service stub for deterministic assertions
* refactor(opencode): migrate agent promise helpers to kilocode module and adopt Effect-based tests
Remove legacy promise-based helpers (`get`, `list`, `defaultAgent`, `remove`)
from the core agent module and update callsites to use the dedicated
`@/kilocode/agent` module directly. Migrate kilocode-specific tests from
`WithInstance.provide` patterns to the `testEffect` helper with Effect
generators for cleaner, more idiomatic test code.
- Remove `makeRuntime` import and exported promise helpers from agent.ts
- Update HTTP API handlers to import from `@/kilocode/agent` instead of
re-exported `Agent` namespace
- Rewrite agent tests to use `load()` helper or Effect service access
- Convert agent-global-config-dirs and agent-skill-permissions tests to
`testEffect` pattern
- Reorder SDK type definitions (BackgroundProcessLogs/WorkspaceWarpError)
* chore(auth): remove legacy promise helpers and replace with direct Effect service access
Eliminate the exported promise-based convenience functions (`get`, `all`,
`set`, `remove`) from the Auth module and replace all callsites with
explicit `AppRuntime.runPromise` or `makeRuntime` invocations that access
`Auth.Service` directly through Effect's service pattern.
- Delete `makeRuntime`-backed promise helpers from auth/index.ts
- Update CLI entrypoint, kilo-sessions, indexing, and server instance to
use `AppRuntime.runPromise(Auth.Service.use(...))` for auth access
- Inject `Auth.Service` as a dependency into the ModelsDev layer and
consume it via Effect generator instead of promise wrapper
- Create a local `makeRuntime` instance in model-cache.ts for non-Effect
callsites that still need promise-based auth access
- Rewrite tests to manipulate auth.json directly on disk with proper
save/restore semantics instead of relying on removed helpers
* refactor(suggestion): convert suggest tool to Effect-native with injected Command dependency
Transform the suggestion tool from async/promise-based implementation to
idiomatic Effect generators with explicit dependency injection of the
Command service rather than importing and calling module-level helpers.
- Convert `resolvePrompt` from async function to Effect generator that
accepts a `Command.Interface` parameter
- Refactor `SuggestTool` definition to yield `Command.Service` from the
Effect context and thread it through to `resolvePrompt`
- Add `Command.Service` as a dependency to the tool registry layer and
provide `Command.defaultLayer` in both production and test wiring
- Remove unused `makeRuntime` import and exported `get` helper from
command/index.ts
- Add explicit type annotations to Auth delegate in server instance
- Rewrite suggestion tests to use `testEffect` helper with a mock
`Command.Service` layer instead of spying on module exports
* feat(git): migrate WorktreeFamily to Effect service and wire Git.Service as dependency
Convert WorktreeFamily.list from an async function using legacy promise
helpers to an Effect generator that yields Git.Service from context,
eliminating the need for the removed `run` promise wrapper in git/index.
- Replace `WorktreeFamily.list()` async function with Effect.fn generator
that obtains Git.Service and InstanceState from the Effect context
- Remove legacy `makeRuntime`/`run`/`runPromise` exports from git module
- Update RecallTool to thread Git.Service through to WorktreeFamily calls
via EffectBridge
- Add Git.Service as a required dependency in tool registry and HTTP
server route layers
- Update all test layers to provide Git.defaultLayer
* chore(mcp): replace legacy promise helpers with Effect-native AppRuntime calls
Remove exported promise-based `status`, `connect`, and `disconnect`
helpers from MCP module and convert the network recovery callsite in
SessionNetwork to use AppRuntime.runPromise with Effect.gen directly.
* refactor(auth): adopt makeRuntime helper for Auth service resolution in kilo modules
Replace AppRuntime.runPromise with locally scoped makeRuntime instances
in kilo-sessions and kilocode/indexing modules, removing the dependency
on the global AppRuntime singleton for Auth service access.
* fix(test): simplify cleanup error handling in provider test
Replace try-catch block with promise .catch() for file unlink operation
during test teardown.
Update session network test to use the correct WithInstance.provide API,
aligning with the refactored import structure introduced in the circular
dependency fix.
Replace direct `Instance.provide` usage with `WithInstance.provide` across
source modules and test files to decouple runtime context provisioning
from the core Instance singleton.
- Update kilo-sessions, remote-sender, roll-call, and plan-followup source
- Remove unused `Instance` imports where only `WithInstance` is needed
- Drop unnecessary `init` param from indexing-worktree test calls
- Add missing `WithInstance` import in fixture-dependent test files
Move the new Anthropic Messages, OpenAI Responses and Vercel AI Gateway
cost-extraction tests out of the shared upstream `test/session/compaction.test.ts`
file into `test/kilocode/provider-cost.test.ts` to keep Kilo-specific test
coverage in a Kilo-owned location and minimize merge conflicts with upstream.
Refactor providerCost to read `usage.raw.cost_details.upstream_inference_cost`,
which both `@ai-sdk/anthropic` (`convertAnthropicUsage`) and `@ai-sdk/openai`
(`convertOpenAIResponsesUsage`) populate with the verbatim OpenRouter usage
object. This unifies the Anthropic Messages and OpenAI Responses cost paths
through a single branch and removes the redundant `metadata.anthropic.usage`
branch (the SDK exposes the same data under both keys for Anthropic, and only
under `raw` for Responses).
Move KILO_CONFIG_DIR profile fallback tests out of the shared upstream
instruction.test.ts into packages/opencode/test/kilocode/instruction.test.ts
to reduce future merge conflicts with opencode.
For the Anthropic Messages API (via OpenRouter or Vercel AI Gateway), the
top-level `cost` field is the gateway fee that Kilo paid (typically 0 for
BYOK), not the user's true spend. Only use `upstream_inference_cost` /
`marketCost`; fall back to the token-based calculation when those are
absent.
Cost reporting already worked when Kilo used OpenRouter chat completions
internally. Extend providerCost to also read cost from the Anthropic
Messages API stream metadata, covering both OpenRouter (Anthropic-style
`usage.cost` / `cost_details.upstream_inference_cost`) and Vercel AI
Gateway (`gateway.cost` / `gateway.marketCost`).
marius-kilocode