Disable the catch-all proxy route that forwards unmatched requests to
app.opencode.ai. This proxy served static assets from an external domain,
which raises privacy/security concerns as users' requests are sent to a
third-party host.
The catch-all route now returns a 404 instead of proxying. The proxy
import is commented out. Changes are marked with kilocode_change markers
to keep upstream merge diffs minimal.
* fix: renamed pattern arrays used for permission rules
* fix: rename savePatternRules to saveAlwaysRules
* feat: generate hierarchical always patterns in bash tool
* feat: validate saveAlwaysRules against always array only
* feat: pass always field through extension bridge to webview
* feat: show hierarchical always patterns in PermissionDock dropdown
* fix: rename pattern to rule in PermissionDock translations, styles, and data-slots
* fix(vscode): correct auto-run comment in PermissionDock
* feat(kilo-vscode): strip trailing wildcard from permission rule labels
* fix: deduplicate permission rules and strip wildcards from display labels
* refactor: move hierarchy to metadata.rules, restore always to arity prefix
* feat: pass always field to permission dock for non-bash tool rules
* fix: correct bash test assertion to check metadata.rules and fix indentation
* fix: hide permission rules dropdown for non-bash tools
* fix: align always-rules route descriptions, whitespace, and restore multi-command tests
The $schema URL in source code and documentation referenced
https://kilo.ai/config.json which returns 404. The correct URL
is https://app.kilo.ai/config.json (already used in test files).
Updated all remaining references in:
- packages/opencode/src/config/config.ts (4 occurrences)
- packages/kilo-docs/pages/code-with-ai/platforms/cli.md (4 occurrences)
- packages/kilo-docs/pages/customize/custom-subagents.md (1 occurrence)
Fixes#7063
* fix: use direct generateText for prompt enhancement instead of LLM.stream
* fix: guard temperature for models that disable it, move instruction to system message
- Check model.capabilities.temperature before setting temperature
- Move the enhance instruction to a system message to prevent user text
from overriding the instruction via prompt injection
Agent.remove() now also scans the .kilocodemodes YAML files that
ModesMigrator reads (VSCode global storage, ~/.kilocode/cli/global/,
~/.kilocodemodes, project .kilocodemodes) and removes the matching
entry by slug, so migrated modes don't reappear after deletion.
Replace the config disable:true approach with a proper Agent.remove()
function that scans config directories for the agent's markdown file
and deletes it, then refreshes state via Instance.dispose().
- Add Agent.remove() in agent.ts with RemoveError
- Add POST /kilocode/agent/remove route
- Mount KilocodeRoutes in server.ts
- Update KiloProvider to call the new backend route
- Regenerate SDK
File paths as query parameters can fail due to URL encoding issues.
Switch to POST /kilocode/skill/remove with the location in the JSON
request body, which avoids encoding problems entirely.
Also log the SDK error response to aid debugging.
The DELETE endpoint was returning data that somehow rendered as empty
rows in the webview. Simplify the approach:
- Webview optimistically removes the skill from its signal immediately
- Extension fires DELETE to the backend (deletes from disk + cache)
- Extension invalidates cachedSkillsMessage so next tab visit fetches
fresh data
- No second skillsLoaded message is sent after removal, avoiding the
stale data overwrite that caused the UI corruption
The DELETE /kilocode/skill endpoint now returns the updated skills
list (Skill.Info[]) instead of a boolean. The extension uses this
response directly to update the webview, eliminating the need for a
separate GET /skill round-trip that could return stale cached data.
Also normalize paths in Skill.remove() with path.resolve() to ensure
location strings match regardless of path format differences.
Rename routes/skill.ts to routes/kilocode.ts with KilocodeRoutes
export, mounted at /kilocode. This is the single home for all future
kilo-specific CLI endpoints, avoiding conflicts with the existing
/kilo gateway routes and keeping all kilo changes out of server.ts.
SDK: client.kilocode.removeSkill()
Extract the inline DELETE /skill endpoint from server.ts into a
dedicated packages/opencode/src/server/routes/skill.ts file, reducing
kilo-specific changes in the shared server.ts and minimizing future
merge conflicts with upstream.
The route is mounted at /skill and uses the same lazy() pattern as
other kilo-specific route files (telemetry, enhance-prompt, etc.).
Add Skill.remove() that deletes the skill directory from disk and
mutates the cached Instance.state in-place so subsequent GET /skill
calls return the updated list.
Add DELETE /skill?location=... server endpoint, regenerate the SDK,
and update KiloProvider to call the SDK method instead of deleting
files directly from the extension.
readMcpSettings() called JSON.parse() without try/catch. In migrate(),
if .kilocode/mcp.json existed but contained malformed JSON, the uncaught
exception propagated out of the dual-read loop, preventing .kilo/mcp.json
from ever being read. The outer loadMcpConfig() catch returned {} instead
of the valid config — silently losing MCP server configuration.
Wrap the file read + parse in try/catch, log a warning, and return null
so the loop continues to the next config directory.
Regression tests added for both readMcpSettings (unit) and migrate
(integration) to prove the bug and verify the fix.
Refs: #6881
Co-authored-by: marius-kiloclaw <marius-kiloclaw@users.noreply.github.com>
The upstream merge (v1.1.54) overwrote Kilo-specific URL handling with
the opencode ShareNext flow, breaking import for app.kilo.ai/s/ URLs.
Restore parsing of https://app.kilo.ai/s/<id> and fetching from
ingest.kilosessions.ai instead of the opncd.ai share API.
* fix: use .kilo instead of .kilocode for config directories
* fix: keep global ~/.kilocode untouched for legacy CLI compat
Only rename project-level .kilocode/ to .kilo/. The global ~/.kilocode
directory must stay because legacy CLI instances and legacy-migration.ts
in kilo-gateway still read from it.
* test: update VS Code extension tests to use .kilo directory paths
* fix: correct paths.ts comment and use specific git exclude entries
- Fix comment referencing ~/.kilo when globalDir() returns ~/.kilocode
- Revert to specific .kilo/ git exclude entries instead of blanket .kilo/
to avoid hiding user-authored rules/workflows/config from git status
* fix: handle legacy per-worktree metadata and stale paths in state
- readMetadata() falls back to .kilocode/ inside worktrees since the
per-worktree metadata dirs aren't renamed by the top-level migration
- Rewrite stale .kilocode/ paths in agent-manager.json on load
* fix: run .kilocode migration at extension activation, not just Agent Manager
Move migration call to the top of activate() so it runs for all users
on every extension startup, before kilo serve is spawned or any code
reads from the .kilo directory.
* fix: update git worktree refs after .kilocode → .kilo rename
After renaming the directory, git's internal .git/worktrees/*/gitdir
files still reference the old .kilocode path. This causes git to lose
track of worktrees, leading to crashes. Both the CLI and extension
migration now rewrite these gitdir files after a successful rename.
* fix: read from both .kilo and .kilocode, write to .kilo
Replace the one-time directory rename migration with a dual-read strategy:
- CLI config (rules, workflows, skills, MCP, project-id): read from both
.kilo/ and .kilocode/ directories, with .kilo taking precedence
- Agent Manager data (worktrees, state, setup scripts): migrate from
.kilocode/ to .kilo/ at startup since the extension exclusively owns these
- Config discovery (paths.ts, config.ts): include .kilocode in directory
and agent/command pattern matching
Key decisions:
- .kilo/ is the new canonical write location for all new data
- .kilocode/ is read as a legacy fallback (no data loss for existing users)
- No directory rename: both dirs can coexist safely
- Agent Manager migration is item-level (moves individual files), not a
full directory rename, so it handles both-dirs-exist gracefully
- Windows path rewrite in WorktreeStateManager handles both / and \ separators
- Workflow/MCP load order: .kilocode first, .kilo second (last wins)
- Rules dedup via seen-set with .kilo checked first (first wins)
- Delete migrate-kilo-dir.ts (no longer needed)
* fix: resolve .git file when fixing worktree refs during migration
When the project root is itself a worktree, .git is a file pointing
at the shared git dir, not a directory. Follow the gitdir pointer to
find the actual .git/worktrees/ location.
* fix: recover partial .kilo migrations and global dirs
Always repair stale git worktree refs when .kilo worktrees already exist so partially migrated repos recover on startup. Also dual-read global skills, rules, and workflows from both legacy and new home directories.
* fix: keep .kilo ahead of legacy config dirs
* fix: narrow legacy agent manager excludes
* chore: link migration cleanup follow-up
- Fix npx command to use --package flag since package has multiple bins
- Remove undocumented autonomous mode (--auto) from Getting Started and Commands
- Remove kilo serve from Commands table (internal, not user-facing)
- Fix kilo session to show actual subcommands (list, delete)
- Remove kilo completion from Commands table (not working)
- Fix table formatting
kiloconnect[bot]