Address review feedback from @lambertjosh: the mdns.ts fallback was
updated but the actual CLI defaults in network.ts and config.ts still
advertised opencode.local. Update both so kilo serve --mdns uses the
correct hostname.
Address review feedback from @lambertjosh: keep the original
opencodeArgs/opencodeProcess variable names from upstream since they
are not user-facing. Introduce a 'bin' variable to change only the
spawned command, minimizing the diff and reducing merge conflicts.
The local `args` variable on line 99 shadowed the `handler(args)` parameter,
causing tsgo to report "used before declaration" errors at line 25. Renamed
to `flags` to avoid the conflict.
Replace user-facing and protocol-visible "opencode" strings with "kilo"
across MCP auth flow, CLI commands, server metadata, and other areas
that were missed or reverted during upstream merges.
Files changed:
- mcp/index.ts: MCP client name and auth toast message
- cli/cmd/mcp.ts: config file reference, placeholder, debug client name
- cli/cmd/pr.ts: binary invocations and user messages
- server/server.ts: OpenAPI spec title and description
- server/mdns.ts: mDNS service host and name
- session/retry.ts: credits URL
- provider/provider.ts: CLI command in error message
- acp/agent.ts: auth method name and description
- tool/webfetch.ts: User-Agent header
* feat: add WarpGrep AI-powered codebase search tool
Add WarpGrep integration as a new tool for intelligent multi-step
codebase search. WarpGrep delegates search to Morph's RL-trained
search agent, which runs parallel tool calls across multiple turns
and returns only relevant code spans.
- Add WarpGrep core client with multi-turn API loop, local tool
executors (ripgrep, file read, directory list), and XML parsing
- Add tool definition gated behind KILO_ENABLE_WARPGREP flag
- Register tool in registry with feature flag gating
- Add warpgrep permission to orchestrator, ask, and explore agents
- Conditionally enhance explore agent prompt when WarpGrep available
- Add unit tests for parsing, file ops, and tool registration
* fix: align warpgrep with Morph XML protocol
* chore: drop warpgrep test changes from branch
* chore: remove warpgrep test files from branch
* refactor: replace custom WarpGrep implementation with @morphllm/morphsdk
- Delete 396-line custom warpgrep.ts, replace with SDK's WarpGrepClient
- Only check MORPH_API_KEY (drop WARPGREP_API_KEY)
- Route through Kilo proxy during free period when no API key is set
- Add actionable error message for when free period ends
- Grep for FREE_PERIOD_TODO to find what to change post-free-period
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: rename warpgrep to codebase_search, add error toast for 429/402
- Rename tool from warpgrep to codebase_search throughout
- Switch proxy URL to /api/gateway
- Detect auth/rate-limit errors (401/402/429) and show actionable
fallback message telling users to set MORPH_API_KEY
- Fire a TUI toast notification on auth/rate-limit errors so users
see a visible popup, not just hidden tool output
- Wire up GlobalBus "global.event" in TUI thread so Bus events from
tools can reach the TUI event system
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* build: bump @morphllm/morphsdk to 0.2.141
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use Bus.publish for toast, revert global.event subscription
Address PR review: emit toast via Bus.publish(TuiEvent.ToastShow)
instead of GlobalBus.emit() so it works in both direct-RPC and
server-backed TUI modes. Revert the global.event subscription in
createEventSource since it's no longer needed and caused double
event delivery.
Also update codebase_search tool description to clarify natural
language input.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add codebase search toggle to experimental settings
Replace KILO_ENABLE_WARPGREP env var with a UI toggle in the
Experimental settings tab. The tool is now gated by the
experimental.codebase_search config field, accessible from both
VSCode settings and TUI config file.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update packages/opencode/src/tool/warpgrep.ts
Co-authored-by: Marius <marius@kilocode.ai>
* feat: limit codebase_search output to prevent context bloat
When search results exceed 45k chars (~15k tokens), degrade to showing
file paths and line ranges instead of full content. Also bumps
@morphllm/morphsdk from 0.2.129 to 0.2.147.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* build: bump @morphllm/morphsdk to 0.2.148
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: format codebaseSearch i18n strings to respect prettier line width
* fix: only advertise codebase_search in explore prompt when feature flag is enabled
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Christiaan Arnoldus <christiaan.arnoldus@outlook.com>
Co-authored-by: Marius <marius@kilocode.ai>
Disable the catch-all proxy route that forwards unmatched requests to
app.opencode.ai. This proxy served static assets from an external domain,
which raises privacy/security concerns as users' requests are sent to a
third-party host.
The catch-all route now returns a 404 instead of proxying. The proxy
import is commented out. Changes are marked with kilocode_change markers
to keep upstream merge diffs minimal.
* fix: renamed pattern arrays used for permission rules
* fix: rename savePatternRules to saveAlwaysRules
* feat: generate hierarchical always patterns in bash tool
* feat: validate saveAlwaysRules against always array only
* feat: pass always field through extension bridge to webview
* feat: show hierarchical always patterns in PermissionDock dropdown
* fix: rename pattern to rule in PermissionDock translations, styles, and data-slots
* fix(vscode): correct auto-run comment in PermissionDock
* feat(kilo-vscode): strip trailing wildcard from permission rule labels
* fix: deduplicate permission rules and strip wildcards from display labels
* refactor: move hierarchy to metadata.rules, restore always to arity prefix
* feat: pass always field to permission dock for non-bash tool rules
* fix: correct bash test assertion to check metadata.rules and fix indentation
* fix: hide permission rules dropdown for non-bash tools
* fix: align always-rules route descriptions, whitespace, and restore multi-command tests
The $schema URL in source code and documentation referenced
https://kilo.ai/config.json which returns 404. The correct URL
is https://app.kilo.ai/config.json (already used in test files).
Updated all remaining references in:
- packages/opencode/src/config/config.ts (4 occurrences)
- packages/kilo-docs/pages/code-with-ai/platforms/cli.md (4 occurrences)
- packages/kilo-docs/pages/customize/custom-subagents.md (1 occurrence)
Fixes#7063
* fix: use direct generateText for prompt enhancement instead of LLM.stream
* fix: guard temperature for models that disable it, move instruction to system message
- Check model.capabilities.temperature before setting temperature
- Move the enhance instruction to a system message to prevent user text
from overriding the instruction via prompt injection
Agent.remove() now also scans the .kilocodemodes YAML files that
ModesMigrator reads (VSCode global storage, ~/.kilocode/cli/global/,
~/.kilocodemodes, project .kilocodemodes) and removes the matching
entry by slug, so migrated modes don't reappear after deletion.
Replace the config disable:true approach with a proper Agent.remove()
function that scans config directories for the agent's markdown file
and deletes it, then refreshes state via Instance.dispose().
- Add Agent.remove() in agent.ts with RemoveError
- Add POST /kilocode/agent/remove route
- Mount KilocodeRoutes in server.ts
- Update KiloProvider to call the new backend route
- Regenerate SDK
File paths as query parameters can fail due to URL encoding issues.
Switch to POST /kilocode/skill/remove with the location in the JSON
request body, which avoids encoding problems entirely.
Also log the SDK error response to aid debugging.
The DELETE endpoint was returning data that somehow rendered as empty
rows in the webview. Simplify the approach:
- Webview optimistically removes the skill from its signal immediately
- Extension fires DELETE to the backend (deletes from disk + cache)
- Extension invalidates cachedSkillsMessage so next tab visit fetches
fresh data
- No second skillsLoaded message is sent after removal, avoiding the
stale data overwrite that caused the UI corruption
The DELETE /kilocode/skill endpoint now returns the updated skills
list (Skill.Info[]) instead of a boolean. The extension uses this
response directly to update the webview, eliminating the need for a
separate GET /skill round-trip that could return stale cached data.
Also normalize paths in Skill.remove() with path.resolve() to ensure
location strings match regardless of path format differences.
Rename routes/skill.ts to routes/kilocode.ts with KilocodeRoutes
export, mounted at /kilocode. This is the single home for all future
kilo-specific CLI endpoints, avoiding conflicts with the existing
/kilo gateway routes and keeping all kilo changes out of server.ts.
SDK: client.kilocode.removeSkill()
Extract the inline DELETE /skill endpoint from server.ts into a
dedicated packages/opencode/src/server/routes/skill.ts file, reducing
kilo-specific changes in the shared server.ts and minimizing future
merge conflicts with upstream.
The route is mounted at /skill and uses the same lazy() pattern as
other kilo-specific route files (telemetry, enhance-prompt, etc.).
Add Skill.remove() that deletes the skill directory from disk and
mutates the cached Instance.state in-place so subsequent GET /skill
calls return the updated list.
Add DELETE /skill?location=... server endpoint, regenerate the SDK,
and update KiloProvider to call the SDK method instead of deleting
files directly from the extension.
readMcpSettings() called JSON.parse() without try/catch. In migrate(),
if .kilocode/mcp.json existed but contained malformed JSON, the uncaught
exception propagated out of the dual-read loop, preventing .kilo/mcp.json
from ever being read. The outer loadMcpConfig() catch returned {} instead
of the valid config — silently losing MCP server configuration.
Wrap the file read + parse in try/catch, log a warning, and return null
so the loop continues to the next config directory.
Regression tests added for both readMcpSettings (unit) and migrate
(integration) to prove the bug and verify the fix.
Refs: #6881
Co-authored-by: marius-kiloclaw <marius-kiloclaw@users.noreply.github.com>
kiloconnect[bot]