Mechanical follow-up to the v1.14.33 merge:
- src/server/routes/ui.ts: remove dead proxy fallback (proxy/createHash/csp were intentionally commented out by Kilo; the Effect/Promise paths still referenced them)
- src/kilocode/{plan-followup,session/prompt}.ts: pass Instance.current to Session.plan(input, instance)
- src/server/routes/instance/httpapi/handlers/session.ts: cast PromptPayload spread to PromptInput (readonly→mutable schema/runtime mismatch)
- src/plugin/index.ts: cast external @opencode-ai/plugin auth plugins through unknown to bridge to local @kilocode/plugin types
- script/build.ts: drop duplicate sourcemap key (Kilo's release-aware version wins)
- test/kilocode/indexing-{startup,worktree}.test.ts: switch from Instance.disposeAll/InstanceBootstrap-as-effect to disposeAllInstances/getBootstrapRunEffect
- test/kilocode/model-cache-org.test.ts: convert Instance.provide init from async fn to Effect
- test/kilocode/kilo-loader-auth.test.ts: drop ModelsDev.Data.reset() (no longer exists)
- test/kilocode/plan-exit-detection.test.ts, plan-followup.test.ts: pass Instance.current to Session.plan
- test/kilocode/{plan-followup,session-list}.test.ts: replace Session.list() with AppRuntime.runPromise(Session.Service.use((svc) => svc.list()))
- Bump all active workflows to action versions that natively target Node 24:
checkout@v6, setup-node@v6, cache@v5, upload-artifact@v7, download-artifact@v8.
Resolves the "Node.js 20 is deprecated" warning in CI logs. The kept
`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` env stays as a no-op safety net (also
in upstream OpenCode).
- test-runner: when running under GitHub Actions, emit a `::warning::`
annotation per flaky file and append a markdown table to
`$GITHUB_STEP_SUMMARY`. mikepenz/action-junit-report already surfaces
failures from the JUnit XML, but flakies pass cleanly on retry and were
invisible in the UI.
The per-file JUnit merge was walking `<testsuite>` tags by hand and closing
on the first `</testsuite>` it found. Bun's junit reporter nests one
`<testsuite>` per `describe` block inside an outer `<testsuite>` for the
file itself, so the inner close was matched and the outer one got dropped.
Every file contributed one unclosed `<testsuite>` to the merged output,
pushing XML depth up until mikepenz/action-junit-report's sax parser
failed with "Unexpected close tag" (and xmllint with "Excessive depth").
Switch to grabbing everything between the outer `<testsuites ...>` and
`</testsuites>` of each file's XML — nested structure is preserved
verbatim, no custom walking needed. Read aggregate counts from the root
`<testsuites>` attributes so nested `tests="..."` attrs don't get
double-counted either.
Validated locally: `xmllint --noout` passes on the merged output for a
mix of files with and without nested describes.
- Lower default runner concurrency from `os.cpus().length` to `min(4, cpus)`.
The bottleneck in CI is shared resources (OAuth callback ports, global
filesystem like `~/.local/share/kilo`), not CPU, so eight parallel Bun
processes were triggering port/FS races instead of going faster.
- Raise per-test timeout from 30s to 60s. Slow `spawn` on Windows was
tripping the 30s limit on tests that were just slow, not broken
(e.g. `session/prompt.test.ts` at ~86s, `provider/provider.test.ts` at ~54s).
- Retry failing files once and surface them as FLAKY in the summary plus a
dedicated section. Bugs still fail on every attempt; contention recovers.
- Drop CI runners from 8vcpu to 4vcpu to match upstream OpenCode — with
concurrency capped at 4, the extra cores bought us nothing.
The upstream build script tries to bundle packages/app/ which was removed in #9845. Guard the embed step so the CLI build still works, and revert the --skip-embed-web-ui workaround from #9885 since it is no longer needed.
Move the initialization of the MCP OAuth callback server from the layer setup to the point where browser authentication is actually required. This prevents unnecessary port binding when authentication is not needed.
Additionally, improve the test runner's XML parsing to correctly handle multiple testsuite attributes and ensure tags are matched accurately.
- Update `packages/opencode/src/mcp/index.ts` to call `McpOAuthCallback.ensureRunning` only upon `UnauthorizedError`.
- Refactor `packages/opencode/script/test-runner.ts` to use a more robust `open` and `sum` logic for test results.
- Add verification to `packages/opencode/test/mcp/oauth-auto-connect.test.ts` to ensure the callback server remains inactive when not needed.
The kilo-cli artifact ballooned from ~1 GB to 1.83 GB after the codebase
indexing PR started emitting external sourcemaps and copying tree-sitter
wasms per target. The resulting 1.83 GB artifact triggered a silent
partial-extract in actions/download-artifact@v4 during build-vscode,
causing the 2026-04-29 publish run to fail with 'CLI binary not found'.
- Skip external sourcemaps in release builds (~620 MB saved across
12 targets); dev builds still emit maps for local debugging.
- Exclude any stray .map files from the CI artifact and skip zstd
compression on binaries (saves ~60 s on upload and reduces the
chance of partial-extract bugs on the download side).
Refs: PR #6966 (commit f74d54c4), run 25096325401
The image was still being pushed as ghcr.io/kilo-org/kilo, which GHCR
links to the archived Kilo-Org/kilo repo. Rename to kilocode so future
releases create a package under the active repo, and document the
one-time GHCR package-visibility/repo-link follow-up in RELEASING.md.
The `Installation.isLocal()` gate in dev-setup rejected locally-built
binaries because KILO_CHANNEL bakes the git branch name, not "local".
`detectRepo()` also failed inside a Bun single-file executable where
`import.meta.url` resolves to a `/$bunfs/` virtual path.
Introduce a build-time `KILO_BUILD_KIND` flag (source/release) derived
from `Script.release`, guard dev-setup/dev-alias registration on it,
and rewrite `detectRepo()` to try KILO_DEV_REPO, `import.meta.url`
(skipping bunfs), `process.execPath`, then `process.cwd()`.
Fixes an issue where GitHub artifact downloads could strip executable bits
from binaries, causing Docker builds to fail when using unpacked dist files
directly rather than published tarballs. The chmod now runs before the
publish check to guarantee binaries are executable.
Imanol Maiztegui