Merge pull request #11301 from Kilo-Org/console-explore-privacy-filter

feat(cli): add a privacy filter to Console model Explore

.changeset/bright-badgers-bring-keys.md

@@ -0,0 +1,7 @@
+---
+"@kilocode/cli": minor
+"@kilocode/kilo-gateway": minor
+"kilo-code": minor
+---
+
+Show a BYOK badge for Kilo Gateway models that can use an enabled personal or organization provider key.

.changeset/calm-providers-smile.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Describe custom providers independently of their selected API protocol.

.changeset/deny-gateway-data-collection.md

@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": patch
+"@kilocode/kilo-gateway": patch
+---
+
+Deny provider data collection for Kilo Gateway requests when prompt-training models are hidden.

.changeset/filter-console-prompt-training-models.md

@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Add a privacy filter to the Console model explorer that hides Kilo Gateway models whose providers may use prompts for training.

.changeset/headless-docs-dialog.md

@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Show docs URL in dialog when no display server is detected on headless Linux systems

.changeset/headless-docs-url.md

@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Show the docs URL in an alert dialog when the browser cannot be opened on headless systems instead of silently failing.

.changeset/hide-reverted-provider-errors.md

@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": patch
+"kilo-code": patch
+---
+
+Hide reverted provider errors so Redo controls remain visible after rewinding a session.

.changeset/keep-diff-identifiers-intact.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Keep changed identifiers intact when highlighting edits within diff lines.

.changeset/permission-apply-patch-diffs.md

@@ -1,5 +0,0 @@
----
-"kilo-code": patch
----
-
-Show apply_patch diffs in the permission prompt before approval.

.changeset/quiet-subagent-finishes.md

@@ -0,0 +1,7 @@
+---
+"@kilocode/cli": patch
+"@kilocode/sdk": patch
+"kilo-code": patch
+---
+
+Limit completion sounds to parent agent sessions.

.changeset/quiet-terminal-panel.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Avoid failing Agent Manager startup when another extension already registered VS Code panel commands.

.changeset/reverts-stream-again.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Keep chat output updating after reverting and resubmitting a prompt.

.changeset/stabilize-agent-manager-transcripts.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Prevent concurrent subagent updates from blanking the Agent Manager webview.

.changeset/swift-pr-hover-cards.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Speed up Agent Manager worktree hover cards so pull request details appear and dismiss more quickly.

.changeset/widen-chat-lane-further.md

@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Widen the chat readable lane from 88ch to 98ch so conversations, tools, and diffs can use more editor space.

.editorconfig

@@ -7,3 +7,8 @@ end_of_line = lf
 indent_style = space
 indent_size = 2
 max_line_length = 80
+
+[*.{kt,kts}]
+indent_size = 4
+tab_width = 4
+ij_kotlin_code_style_defaults = KOTLIN_OFFICIAL

.github/actions/setup-bun/action.yml

@@ -23,7 +23,7 @@ runs:
         fi
 
     - name: Setup Bun
-      uses: oven-sh/setup-bun@v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
         bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
         bun-download-url: ${{ steps.bun-url.outputs.url }}
@@ -33,8 +33,9 @@ runs:
       shell: bash
       run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
 
-    - name: Cache Bun dependencies
-      uses: actions/cache@v4
+    - name: Restore Bun dependencies
+      id: bun-cache
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ steps.cache.outputs.dir }}
         key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
@@ -56,3 +57,10 @@ runs:
           bun install ${{ inputs.install-flags }}
         fi
       shell: bash
+
+    - name: Save Bun dependencies
+      if: steps.bun-cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.cache.outputs.dir }}
+        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}

.github/actions/setup-git-committer/action.yml

@@ -21,7 +21,7 @@ runs:
   steps:
     - name: Create app token
       id: apptoken
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
       with:
         # kilocode_change start
         app-id: ${{ inputs['kilo-maintainer-app-id'] }}
@@ -39,6 +39,15 @@ runs:
     - name: Clear checkout auth
       run: |
         git config --local --unset-all http.https://github.com/.extraheader || true
+        # kilocode_change start
+        keys="$(git config --local --name-only --get-regexp '^includeIf\.gitdir:' || true)"
+        for key in $keys; do
+          path="$(git config --local --get "$key" || true)"
+          case "$path" in
+            *git-credentials-*.config) git config --local --unset-all "$key" || true ;;
+          esac
+        done
+        # kilocode_change end
       shell: bash
 
     - name: Configure git remote

.github/codeql/codeql-config.yml

@@ -0,0 +1,12 @@
+# kilocode_change - new file
+name: Critical-only CodeQL config
+
+query-filters:
+  - include:
+      kind:
+        - problem
+        - path-problem
+        - alert
+        - path-alert
+      tags contain: security
+      security-severity: /^(9(\.[0-9])?|10(\.0)?)$/

.github/pull_request_template.md

@@ -1,3 +1,9 @@
+## Issue
+
+<!-- Reference an existing issue with `Fixes #123`, `Closes #123`, or equivalent linked issue wording. -->
+
+Fixes #
+
 ## Context
 
 <!-- Brief description of WHAT you’re doing and WHY. -->
@@ -6,11 +12,13 @@
 
 <!--
 
-Some description of HOW you achieved it. Perhaps give a high level description of the program flow. Did you need to refactor something? What tradeoffs did you take? Are there things in here which you’d particularly like people to pay close attention to?
+Some description of HOW you achieved it. Perhaps give a high level description of the program flow. Did you need to refactor something? What tradeoffs did you take? Are there things in here which you’d particularly like people to pay close attention to? Keep this focused on context reviewers cannot infer from the diff; skip file-by-file summaries, placeholders, and other filler.
 
 -->
 
-## Screenshots
+## Screenshots / Video
+
+<!-- Required for visual changes. Include the relevant before/after or resulting state. -->
 
 | before | after |
 |---|---|
@@ -18,18 +26,49 @@ Some description of HOW you achieved it. Perhaps give a high level description o
 
 ## How to Test
 
+### Manual/local verification
+
 <!--
-
-A straightforward scenario of how to test your changes will help reviewers that are not familiar with the part of the code that you are changing but want to see it in action. This section can include a description or step-by-step instructions of how to get to the state of v2 that your change affects.
-
-A "How To Test" section can look something like this:
-
-- Sign in with a user with tracks
-- Activate `show_awesome_cat_gifs` feature (add `?feature.show_awesome_cat_gifs=1` to your URL)
-- You should see a GIF with cats dancing
-
+Describe local CLI, extension, or docs verification. Example:
+- Opened the updated settings page and confirmed the new copy appears
 -->
 
+-
+
+### Reviewer test steps
+
+<!--
+Provide steps reviewers can retrace. Example:
+1. Sign in with a user with tracks
+2. Activate `show_awesome_cat_gifs` feature by adding `?feature.show_awesome_cat_gifs=1` to your URL
+3. Confirm you see a GIF with cats dancing
+-->
+
+-
+
+### Blocked checks and substitute verification
+
+<!--
+If a relevant command could not be completed, name the command, explain the blocker or failure, and describe the substitute verification performed. Example:
+- `bun run test:integration` could not complete because the required API key is unavailable; substitute verification was testing the affected flow manually in the development extension
+-->
+
+-
+
+<!--
+Every PR marked ready for review must include testing evidence. A bare "Not tested" or "N/A" answer is not sufficient. For each piece of evidence make clear if the test was executed by the agent or by a human
+
+Docs-only, config-only, and similar changes still need concrete evidence. For examples, see [Testing Evidence for Pull Requests](https://kilo.ai/docs/contributing/development-environment#testing-evidence-for-pull-requests). Draft PRs may be incomplete until marked ready for review.
+-->
+
+## Checklist
+
+- [ ] Issue linked above, or exception explained
+- [ ] Tests/verification described
+- [ ] Screenshots/video included for visual changes, or marked N/A
+- [ ] Changeset considered for user-facing changes
+- [ ] I personally reviewed the diff and can explain the changes, including any AI-assisted work.
+
 ## Get in Touch
 
 <!-- We'd love to have a way to chat with you about your changes if necessary. If you're in the [Kilo Code Discord](https://kilo.ai/discord), please share your handle here. -->

.github/workflows/auto-docs.yml

@@ -1,35 +1,113 @@
-name: Trigger webhook for feat PRs
+name: Auto-docs dry-run intake
 
+# Trigger on merged feature PRs, or manually with a specific PR number.
+# IMPORTANT: This workflow intentionally does NOT check out PR code and does NOT
+# execute any code from the PR branch. It only reads PR metadata and forwards it
+# to a webhook. This is required for safe use of pull_request_target on a public repo.
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to test"
+        required: true
+
+# Minimal permissions: read repo contents and PR metadata only.
+permissions:
+  contents: read
+  pull-requests: read
+
+# One run per PR at a time. Does not cancel in progress — let the current run
+# finish so we don't drop events when a PR is quickly closed/reopened/closed.
+concurrency:
+  group: auto-docs-${{ github.event.pull_request.number || inputs.pr_number }}
+  cancel-in-progress: false
 
 jobs:
-  call-webhook:
+  call-valtown:
     if: >
-      github.event.pull_request.merged == true &&
-      (startsWith(github.event.pull_request.title, 'feat:') ||
-       startsWith(github.event.pull_request.title, 'feat('))
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event.pull_request.merged == true &&
+        (
+          startsWith(github.event.pull_request.title, 'feat:') ||
+          startsWith(github.event.pull_request.title, 'feat(')
+        )
+      )
+
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+
     steps:
-      - name: Send webhook safely
+      - name: Build webhook payload
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER_FROM_EVENT: ${{ github.event.pull_request.number }}
+          PR_NUMBER_FROM_INPUT: ${{ inputs.pr_number }}
         run: |
-          payload=$(jq -n \
-            --arg repo "${GITHUB_REPOSITORY}" \
-            --arg pr_number "${{ github.event.pull_request.number }}" \
-            --arg title "${{ github.event.pull_request.title }}" \
-            --arg body "${{ github.event.pull_request.body }}" \
-            --arg author "${{ github.event.pull_request.user.login }}" \
-            --arg merged_at "${{ github.event.pull_request.merged_at }}" \
+          set -euo pipefail
+
+          PR_NUMBER="${PR_NUMBER_FROM_EVENT:-$PR_NUMBER_FROM_INPUT}"
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "Missing PR number"
+            exit 1
+          fi
+
+          gh api "repos/$REPO/pulls/$PR_NUMBER" > pr.json
+
+          jq -n \
+            --arg event_name "$EVENT_NAME" \
+            --arg repo "$REPO" \
+            --arg pr_number "$PR_NUMBER" \
+            --slurpfile pr pr.json \
             '{
+              event_name: $event_name,
               repo: $repo,
               pr_number: $pr_number,
-              title: $title,
-              description: $body,
-              author: $author,
-              merged_at: $merged_at
-            }'
-          )
-          curl --fail-with-body -X POST "${{ secrets.DOC_WEBHOOK_URL }}" \
+              title: $pr[0].title,
+              description: ($pr[0].body // ""),
+              author: $pr[0].user.login,
+              merged_at: ($pr[0].merged_at // ""),
+              pr_url: $pr[0].html_url,
+              base_branch: $pr[0].base.ref,
+              head_branch: $pr[0].head.ref
+            }' > payload.json
+
+          echo "Payload created:"
+          jq '{
+            event_name,
+            repo,
+            pr_number,
+            title,
+            author,
+            merged_at,
+            pr_url,
+            base_branch,
+            head_branch
+          }' payload.json
+
+      - name: Send webhook to Val Town
+        env:
+          DOC_WEBHOOK_URL: ${{ secrets.DOC_WEBHOOK_URL }}
+          DOC_WEBHOOK_SECRET: ${{ secrets.DOC_WEBHOOK_SECRET }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DOC_WEBHOOK_URL:-}" ]; then
+            echo "DOC_WEBHOOK_URL secret is not set"
+            exit 1
+          fi
+
+          if [ -z "${DOC_WEBHOOK_SECRET:-}" ]; then
+            echo "DOC_WEBHOOK_SECRET secret is not set"
+            exit 1
+          fi
+
+          curl --fail-with-body -sS -X POST "$DOC_WEBHOOK_URL" \
             -H "Content-Type: application/json" \
-            --data-raw "$payload"
+            -H "X-Docs-Webhook-Secret: $DOC_WEBHOOK_SECRET" \
+            --data-binary @payload.json

.github/workflows/beta.yml

@@ -14,8 +14,9 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
+          persist-credentials: false # kilocode_change
           fetch-depth: 0
 
       - name: Setup Bun

.github/workflows/check-forbidden-strings.yml

@@ -0,0 +1,21 @@
+# kilocode_change - new file
+name: Check forbidden strings
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check forbidden strings
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6 # kilocode_change
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Run check
+        run: bun run script/check-forbidden-strings.ts

.github/workflows/check-kilo-generated-artifacts.yml

@@ -0,0 +1,27 @@
+# kilocode_change - new file
+name: Check Kilo generated artifacts
+
+on:
+  pull_request:
+    paths:
+      - ".gitignore"
+      - ".github/workflows/check-kilo-generated-artifacts.yml"
+      - ".kilo/**"
+      - ".kilocode/**"
+      - "script/check-kilo-generated-artifacts.ts"
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: Check Kilo generated artifacts
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6 # kilocode_change
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Run check
+        run: bun run script/check-kilo-generated-artifacts.ts

.github/workflows/check-md-table-padding.yml

@@ -14,7 +14,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6 # kilocode_change
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 

.github/workflows/check-opencode-annotations.yml

@@ -5,10 +5,6 @@ on:
     paths:
       - ".github/**"
       - "github/**"
-      - "sdks/vscode/**"
-      - "packages/app/**"
-      - "packages/desktop/**"
-      - "packages/desktop-electron/**"
       - "packages/extensions/**"
       - "packages/opencode/**"
       - "packages/script/**"
@@ -24,7 +20,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6 # kilocode_change
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -40,3 +36,11 @@ jobs:
           else
             echo "No PR base SHA available (workflow_dispatch without PR context) — skipping."
           fi
+
+      # kilocode_change start
+      - name: Check Effect Promise facade allowlist
+        run: bun run script/check-opencode-promise-facades.ts
+
+      - name: Check workflow allowlist
+        run: bun run script/check-workflows.ts
+      # kilocode_change end

.github/workflows/close-issues.yml

@@ -1,24 +0,0 @@
-name: close-issues
-
-on:
-  schedule:
-    - cron: "0 2 * * *" # Daily at 2:00 AM
-  workflow_dispatch:
-
-jobs:
-  close:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Close stale issues
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: bun script/github/close-issues.ts

.github/workflows/close-stale-prs.yml

@@ -1,236 +0,0 @@
-name: close-stale-prs # kilocode_change
-
-on:
-  workflow_dispatch:
-    inputs:
-      dryRun:
-        description: "Log actions without closing PRs"
-        type: boolean
-        default: false
-  schedule:
-    - cron: "0 6 * * *"
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  close-stale-prs:
-    if: github.repository == 'Kilo-Org/kilocode'
-    runs-on: blacksmith-2vcpu-ubuntu-2404 # kilocode_change
-    timeout-minutes: 15
-    steps:
-      - name: Close inactive PRs
-        uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const DAYS_INACTIVE = 60
-            const MAX_RETRIES = 3
-
-            // Adaptive delay: fast for small batches, slower for large to respect
-            // GitHub's 80 content-generating requests/minute limit
-            const SMALL_BATCH_THRESHOLD = 10
-            const SMALL_BATCH_DELAY_MS = 1000  // 1s for daily operations (≤10 PRs)
-            const LARGE_BATCH_DELAY_MS = 2000  // 2s for backlog (>10 PRs) = ~30 ops/min, well under 80 limit
-
-            const startTime = Date.now()
-            const cutoff = new Date(Date.now() - DAYS_INACTIVE * 24 * 60 * 60 * 1000)
-            const { owner, repo } = context.repo
-            const dryRun = context.payload.inputs?.dryRun === "true"
-
-            core.info(`Dry run mode: ${dryRun}`)
-            core.info(`Cutoff date: ${cutoff.toISOString()}`)
-
-            function sleep(ms) {
-              return new Promise(resolve => setTimeout(resolve, ms))
-            }
-
-            async function withRetry(fn, description = 'API call') {
-              let lastError
-              for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-                try {
-                  const result = await fn()
-                  return result
-                } catch (error) {
-                  lastError = error
-                  const isRateLimited = error.status === 403 &&
-                    (error.message?.includes('rate limit') || error.message?.includes('secondary'))
-
-                  if (!isRateLimited) {
-                    throw error
-                  }
-
-                  // Parse retry-after header, default to 60 seconds
-                  const retryAfter = error.response?.headers?.['retry-after']
-                    ? parseInt(error.response.headers['retry-after'])
-                    : 60
-
-                  // Exponential backoff: retryAfter * 2^attempt
-                  const backoffMs = retryAfter * 1000 * Math.pow(2, attempt)
-
-                  core.warning(`${description}: Rate limited (attempt ${attempt + 1}/${MAX_RETRIES}). Waiting ${backoffMs / 1000}s before retry...`)
-
-                  await sleep(backoffMs)
-                }
-              }
-              core.error(`${description}: Max retries (${MAX_RETRIES}) exceeded`)
-              throw lastError
-            }
-
-            const query = `
-              query($owner: String!, $repo: String!, $cursor: String) {
-                repository(owner: $owner, name: $repo) {
-                  pullRequests(first: 100, states: OPEN, after: $cursor) {
-                    pageInfo {
-                      hasNextPage
-                      endCursor
-                    }
-                    nodes {
-                      number
-                      title
-                      author {
-                        login
-                      }
-                      createdAt
-                      commits(last: 1) {
-                        nodes {
-                          commit {
-                            committedDate
-                          }
-                        }
-                      }
-                      comments(last: 1) {
-                        nodes {
-                          createdAt
-                        }
-                      }
-                      reviews(last: 1) {
-                        nodes {
-                          createdAt
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            `
-
-            const allPrs = []
-            let cursor = null
-            let hasNextPage = true
-            let pageCount = 0
-
-            while (hasNextPage) {
-              pageCount++
-              core.info(`Fetching page ${pageCount} of open PRs...`)
-
-              const result = await withRetry(
-                () => github.graphql(query, { owner, repo, cursor }),
-                `GraphQL page ${pageCount}`
-              )
-
-              allPrs.push(...result.repository.pullRequests.nodes)
-              hasNextPage = result.repository.pullRequests.pageInfo.hasNextPage
-              cursor = result.repository.pullRequests.pageInfo.endCursor
-
-              core.info(`Page ${pageCount}: fetched ${result.repository.pullRequests.nodes.length} PRs (total: ${allPrs.length})`)
-
-              // Delay between pagination requests (use small batch delay for reads)
-              if (hasNextPage) {
-                await sleep(SMALL_BATCH_DELAY_MS)
-              }
-            }
-
-            core.info(`Found ${allPrs.length} open pull requests`)
-
-            const stalePrs = allPrs.filter((pr) => {
-              const dates = [
-                new Date(pr.createdAt),
-                pr.commits.nodes[0] ? new Date(pr.commits.nodes[0].commit.committedDate) : null,
-                pr.comments.nodes[0] ? new Date(pr.comments.nodes[0].createdAt) : null,
-                pr.reviews.nodes[0] ? new Date(pr.reviews.nodes[0].createdAt) : null,
-              ].filter((d) => d !== null)
-
-              const lastActivity = dates.sort((a, b) => b.getTime() - a.getTime())[0]
-
-              if (!lastActivity || lastActivity > cutoff) {
-                core.info(`PR #${pr.number} is fresh (last activity: ${lastActivity?.toISOString() || "unknown"})`)
-                return false
-              }
-
-              core.info(`PR #${pr.number} is STALE (last activity: ${lastActivity.toISOString()})`)
-              return true
-            })
-
-            if (!stalePrs.length) {
-              core.info("No stale pull requests found.")
-              return
-            }
-
-            core.info(`Found ${stalePrs.length} stale pull requests`)
-
-            // ============================================
-            // Close stale PRs
-            // ============================================
-            const requestDelayMs = stalePrs.length > SMALL_BATCH_THRESHOLD
-              ? LARGE_BATCH_DELAY_MS
-              : SMALL_BATCH_DELAY_MS
-
-            core.info(`Using ${requestDelayMs}ms delay between operations (${stalePrs.length > SMALL_BATCH_THRESHOLD ? 'large' : 'small'} batch mode)`)
-
-            let closedCount = 0
-            let skippedCount = 0
-
-            for (const pr of stalePrs) {
-              const issue_number = pr.number
-              const closeComment = `Closing this pull request because it has had no updates for more than ${DAYS_INACTIVE} days. If you plan to continue working on it, feel free to reopen or open a new PR.`
-
-              if (dryRun) {
-                core.info(`[dry-run] Would close PR #${issue_number} from ${pr.author?.login || 'unknown'}: ${pr.title}`)
-                continue
-              }
-
-              try {
-                // Add comment
-                await withRetry(
-                  () => github.rest.issues.createComment({
-                    owner,
-                    repo,
-                    issue_number,
-                    body: closeComment,
-                  }),
-                  `Comment on PR #${issue_number}`
-                )
-
-                // Close PR
-                await withRetry(
-                  () => github.rest.pulls.update({
-                    owner,
-                    repo,
-                    pull_number: issue_number,
-                    state: "closed",
-                  }),
-                  `Close PR #${issue_number}`
-                )
-
-                closedCount++
-                core.info(`Closed PR #${issue_number} from ${pr.author?.login || 'unknown'}: ${pr.title}`)
-
-                // Delay before processing next PR
-                await sleep(requestDelayMs)
-              } catch (error) {
-                skippedCount++
-                core.error(`Failed to close PR #${issue_number}: ${error.message}`)
-              }
-            }
-
-            const elapsed = Math.round((Date.now() - startTime) / 1000)
-            core.info(`\n========== Summary ==========`)
-            core.info(`Total open PRs found: ${allPrs.length}`)
-            core.info(`Stale PRs identified: ${stalePrs.length}`)
-            core.info(`PRs closed: ${closedCount}`)
-            core.info(`PRs skipped (errors): ${skippedCount}`)
-            core.info(`Elapsed time: ${elapsed}s`)
-            core.info(`=============================`)

.github/workflows/codeql-kotlin.yml

@@ -0,0 +1,62 @@
+# kilocode_change - new file
+name: "CodeQL Kotlin"
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "packages/kilo-jetbrains/**"
+      - ".github/workflows/codeql-kotlin.yml"
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "packages/kilo-jetbrains/**"
+      - ".github/workflows/codeql-kotlin.yml"
+  schedule:
+    - cron: "29 10 * * 5"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze (java-kotlin)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: manual
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Build Java/Kotlin
+        shell: bash
+        run: ./gradlew typecheck --rerun-tasks --no-build-cache
+        working-directory: packages/kilo-jetbrains
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"

.github/workflows/codeql.yml

@@ -0,0 +1,81 @@
+# kilocode_change - new file
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "29 10 * * 5"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/compliance-close.yml

@@ -1,96 +0,0 @@
-name: compliance-close
-
-on:
-  schedule:
-    # Run every 30 minutes to check for expired compliance windows
-    - cron: "*/30 * * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  close-non-compliant:
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    runs-on: ubuntu-latest
-    steps:
-      - name: Close non-compliant issues and PRs after 2 hours
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { data: items } = await github.rest.issues.listForRepo({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: 'needs:compliance',
-              state: 'open',
-              per_page: 100,
-            });
-
-            if (items.length === 0) {
-              core.info('No open issues/PRs with needs:compliance label');
-              return;
-            }
-
-            const now = Date.now();
-            const twoHours = 2 * 60 * 60 * 1000;
-
-            for (const item of items) {
-              const isPR = !!item.pull_request;
-              const kind = isPR ? 'PR' : 'issue';
-
-              const { data: comments } = await github.rest.issues.listComments({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: item.number,
-              });
-
-              const complianceComment = comments.find(c => c.body.includes('<!-- issue-compliance -->'));
-              if (!complianceComment) continue;
-
-              const commentAge = now - new Date(complianceComment.created_at).getTime();
-              if (commentAge < twoHours) {
-                core.info(`${kind} #${item.number} still within 2-hour window (${Math.round(commentAge / 60000)}m elapsed)`);
-                continue;
-              }
-
-              const closeMessage = isPR
-                ? 'This pull request has been automatically closed because it was not updated to meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md) within the 2-hour window.\n\nFeel free to open a new pull request that follows our guidelines.'
-                : 'This issue has been automatically closed because it was not updated to meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md) within the 2-hour window.\n\nFeel free to open a new issue that follows our issue templates.';
-
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: item.number,
-                body: closeMessage,
-              });
-
-              try {
-                await github.rest.issues.removeLabel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: item.number,
-                  name: 'needs:compliance',
-                });
-              } catch (e) {}
-
-              if (isPR) {
-                await github.rest.pulls.update({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: item.number,
-                  state: 'closed',
-                });
-              } else {
-                await github.rest.issues.update({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: item.number,
-                  state: 'closed',
-                  state_reason: 'not_planned',
-                });
-              }
-
-              core.info(`Closed non-compliant ${kind} #${item.number} after 2-hour window`);
-            }

.github/workflows/containers.yml

@@ -3,7 +3,7 @@ name: containers
 on:
   push:
     branches:
-      - dev
+      - main # kilocode_change
     paths:
       - packages/containers/**
       - .github/workflows/containers.yml
@@ -26,18 +26,18 @@ jobs:
           OWNER: ${{ github.repository_owner }}
       # kilocode_change end
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6 # kilocode_change
 
       - uses: ./.github/actions/setup-bun
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/daily-issues-recap.yml

@@ -1,173 +0,0 @@
-name: daily-issues-recap
-
-on:
-  schedule:
-    # Run at 6 PM EST (23:00 UTC, or 22:00 UTC during daylight saving)
-    - cron: "0 23 * * *"
-  workflow_dispatch: # Allow manual trigger for testing
-
-jobs:
-  daily-recap:
-    # kilocode_change start - disabled for kilo-cli fork (OpenCode Discord integration)
-    if: false
-    # kilocode_change end
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      contents: read
-      issues: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: ./.github/actions/setup-bun
-
-      - name: Install opencode
-        run: curl -fsSL https://opencode.ai/install | bash
-
-      - name: Generate daily issues recap
-        id: recap
-        env:
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          KILO_PERMISSION: |
-            {
-              "bash": {
-                "*": "deny",
-                "gh issue*": "allow",
-                "gh search*": "allow"
-              },
-              "webfetch": "deny",
-              "edit": "deny",
-              "write": "deny"
-            }
-        run: |
-          # Get today's date range
-          TODAY=$(date -u +%Y-%m-%d)
-
-          opencode run -m kilo/anthropic/claude-sonnet-4.5 "Generate a daily issues recap for the OpenCode repository.
-
-          TODAY'S DATE: ${TODAY}
-
-          STEP 1: Gather today's issues
-          Search for all OPEN issues created today (${TODAY}) using:
-          gh issue list --repo ${{ github.repository }} --state open --search \"created:${TODAY}\" --json number,title,body,labels,state,comments,createdAt,author --limit 500
-
-          IMPORTANT: EXCLUDE all issues authored by Anomaly team members. Filter out issues where the author login matches ANY of these:
-          adamdotdevin, Brendonovich, fwang, Hona, iamdavidhill, jayair, kitlangton, kommander, MrMushrooooom, R44VC0RP, rekram1-node, thdxr
-          This recap is specifically for COMMUNITY (external) issues only.
-
-          STEP 2: Analyze and categorize
-          For each issue created today, categorize it:
-
-          **Severity Assessment:**
-          - CRITICAL: Crashes, data loss, security issues, blocks major functionality
-          - HIGH: Significant bugs affecting many users, important features broken
-          - MEDIUM: Bugs with workarounds, minor features broken
-          - LOW: Minor issues, cosmetic, nice-to-haves
-
-          **Activity Assessment:**
-          - Note issues with high comment counts or engagement
-          - Note issues from repeat reporters (check if author has filed before)
-
-          STEP 3: Cross-reference with existing issues
-          For issues that seem like feature requests or recurring bugs:
-          - Search for similar older issues to identify patterns
-          - Note if this is a frequently requested feature
-          - Identify any issues that are duplicates of long-standing requests
-
-          STEP 4: Generate the recap
-          Create a structured recap with these sections:
-
-          ===DISCORD_START===
-          **Daily Issues Recap - ${TODAY}**
-
-          **Summary Stats**
-          - Total issues opened today: [count]
-          - By category: [bugs/features/questions]
-
-          **Critical/High Priority Issues**
-          [List any CRITICAL or HIGH severity issues with brief descriptions and issue numbers]
-
-          **Most Active/Discussed**
-          [Issues with significant engagement or from active community members]
-
-          **Trending Topics**
-          [Patterns noticed - e.g., 'Multiple reports about X', 'Continued interest in Y feature']
-
-          **Duplicates & Related**
-          [Issues that relate to existing open issues]
-          ===DISCORD_END===
-
-          STEP 5: Format for Discord
-          Format the recap as a Discord-compatible message:
-          - Use Discord markdown (**, __, etc.)
-          - BE EXTREMELY CONCISE - this is an EOD summary, not a detailed report
-          - Use hyperlinked issue numbers with suppressed embeds: [#1234](<https://github.com/${{ github.repository }}/issues/1234>)
-          - Group related issues on single lines where possible
-          - Add emoji sparingly for critical items only
-          - HARD LIMIT: Keep under 1800 characters total
-          - Skip sections that have nothing notable (e.g., if no critical issues, omit that section)
-          - Prioritize signal over completeness - only surface what matters
-
-          OUTPUT: Output ONLY the content between ===DISCORD_START=== and ===DISCORD_END=== markers. Include the markers so I can extract it." > /tmp/recap_raw.txt
-
-          # Extract only the Discord message between markers
-          sed -n '/===DISCORD_START===/,/===DISCORD_END===/p' /tmp/recap_raw.txt | grep -v '===DISCORD' > /tmp/recap.txt
-
-          echo "recap_file=/tmp/recap.txt" >> $GITHUB_OUTPUT
-
-      - name: Post to Discord
-        env:
-          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_ISSUES_WEBHOOK_URL }}
-        run: |
-          if [ -z "$DISCORD_WEBHOOK_URL" ]; then
-            echo "Warning: DISCORD_ISSUES_WEBHOOK_URL secret not set, skipping Discord post"
-            cat /tmp/recap.txt
-            exit 0
-          fi
-
-          # Read the recap
-          RECAP_RAW=$(cat /tmp/recap.txt)
-          RECAP_LENGTH=${#RECAP_RAW}
-
-          echo "Recap length: ${RECAP_LENGTH} chars"
-
-          # Function to post a message to Discord
-          post_to_discord() {
-            local msg="$1"
-            local content=$(echo "$msg" | jq -Rs '.')
-            curl -s -H "Content-Type: application/json" \
-                 -X POST \
-                 -d "{\"content\": ${content}}" \
-                 "$DISCORD_WEBHOOK_URL"
-            sleep 1
-          }
-
-          # If under limit, send as single message
-          if [ "$RECAP_LENGTH" -le 1950 ]; then
-            post_to_discord "$RECAP_RAW"
-          else
-            echo "Splitting into multiple messages..."
-            remaining="$RECAP_RAW"
-            while [ ${#remaining} -gt 0 ]; do
-              if [ ${#remaining} -le 1950 ]; then
-                post_to_discord "$remaining"
-                break
-              else
-                chunk="${remaining:0:1900}"
-                last_newline=$(echo "$chunk" | grep -bo $'\n' | tail -1 | cut -d: -f1)
-                if [ -n "$last_newline" ] && [ "$last_newline" -gt 500 ]; then
-                  chunk="${remaining:0:$last_newline}"
-                  remaining="${remaining:$((last_newline+1))}"
-                else
-                  chunk="${remaining:0:1900}"
-                  remaining="${remaining:1900}"
-                fi
-                post_to_discord "$chunk"
-              fi
-            done
-          fi
-
-          echo "Posted daily recap to Discord"

.github/workflows/daily-pr-recap.yml

@@ -1,176 +0,0 @@
-name: daily-pr-recap
-
-on:
-  schedule:
-    # Run at 5pm EST (22:00 UTC, or 21:00 UTC during daylight saving)
-    - cron: "0 22 * * *"
-  workflow_dispatch: # Allow manual trigger for testing
-
-jobs:
-  pr-recap:
-    # kilocode_change start - disabled for kilo-cli fork (OpenCode Discord integration)
-    if: false
-    # kilocode_change end
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      contents: read
-      pull-requests: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: ./.github/actions/setup-bun
-
-      - name: Install opencode
-        run: curl -fsSL https://opencode.ai/install | bash
-
-      - name: Generate daily PR recap
-        id: recap
-        env:
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          KILO_PERMISSION: |
-            {
-              "bash": {
-                "*": "deny",
-                "gh pr*": "allow",
-                "gh search*": "allow"
-              },
-              "webfetch": "deny",
-              "edit": "deny",
-              "write": "deny"
-            }
-        run: |
-          TODAY=$(date -u +%Y-%m-%d)
-
-          opencode run -m kilo/anthropic/claude-sonnet-4.5 "Generate a daily PR activity recap for the OpenCode repository.
-
-          TODAY'S DATE: ${TODAY}
-
-          STEP 1: Gather PR data
-          Run these commands to gather PR information. ONLY include OPEN PRs created or updated TODAY (${TODAY}):
-
-          # Open PRs created today
-          gh pr list --repo ${{ github.repository }} --state open --search \"created:${TODAY}\" --json number,title,author,labels,createdAt,updatedAt,reviewDecision,isDraft,additions,deletions --limit 100
-
-          # Open PRs with activity today (updated today)
-          gh pr list --repo ${{ github.repository }} --state open --search \"updated:${TODAY}\" --json number,title,author,labels,createdAt,updatedAt,reviewDecision,isDraft,additions,deletions --limit 100
-
-          IMPORTANT: EXCLUDE all PRs authored by Anomaly team members. Filter out PRs where the author login matches ANY of these:
-          adamdotdevin, Brendonovich, fwang, Hona, iamdavidhill, jayair, kitlangton, kommander, MrMushrooooom, R44VC0RP, rekram1-node, thdxr
-          This recap is specifically for COMMUNITY (external) contributions only.
-
-
-
-          STEP 2: For high-activity PRs, check comment counts
-          For promising PRs, run:
-          gh pr view [NUMBER] --repo ${{ github.repository }} --json comments --jq '[.comments[] | select(.author.login != \"copilot-pull-request-reviewer\" and .author.login != \"github-actions\")] | length'
-
-          IMPORTANT: When counting comments/activity, EXCLUDE these bot accounts:
-          - copilot-pull-request-reviewer
-          - github-actions
-
-          STEP 3: Identify what matters (ONLY from today's PRs)
-
-          **Bug Fixes From Today:**
-          - PRs with 'fix' or 'bug' in title created/updated today
-          - Small bug fixes (< 100 lines changed) that are easy to review
-          - Bug fixes from community contributors
-
-          **High Activity Today:**
-          - PRs with significant human comments today (excluding bots listed above)
-          - PRs with back-and-forth discussion today
-
-          **Quick Wins:**
-          - Small PRs (< 50 lines) that are approved or nearly approved
-          - PRs that just need a final review
-
-          STEP 4: Generate the recap
-          Create a structured recap:
-
-          ===DISCORD_START===
-          **Daily PR Recap - ${TODAY}**
-
-          **New PRs Today**
-          [PRs opened today - group by type: bug fixes, features, etc.]
-
-          **Active PRs Today**
-          [PRs with activity/updates today - significant discussion]
-
-          **Quick Wins**
-          [Small PRs ready to merge]
-          ===DISCORD_END===
-
-          STEP 5: Format for Discord
-          - Use Discord markdown (**, __, etc.)
-          - BE EXTREMELY CONCISE - surface what we might miss
-          - Use hyperlinked PR numbers with suppressed embeds: [#1234](<https://github.com/${{ github.repository }}/pull/1234>)
-          - Include PR author: [#1234](<url>) (@author)
-          - For bug fixes, add brief description of what it fixes
-          - Show line count for quick wins: \"(+15/-3 lines)\"
-          - HARD LIMIT: Keep under 1800 characters total
-          - Skip empty sections
-          - Focus on PRs that need human eyes
-
-          OUTPUT: Output ONLY the content between ===DISCORD_START=== and ===DISCORD_END=== markers. Include the markers so I can extract it." > /tmp/pr_recap_raw.txt
-
-          # Extract only the Discord message between markers
-          sed -n '/===DISCORD_START===/,/===DISCORD_END===/p' /tmp/pr_recap_raw.txt | grep -v '===DISCORD' > /tmp/pr_recap.txt
-
-          echo "recap_file=/tmp/pr_recap.txt" >> $GITHUB_OUTPUT
-
-      - name: Post to Discord
-        env:
-          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_ISSUES_WEBHOOK_URL }}
-        run: |
-          if [ -z "$DISCORD_WEBHOOK_URL" ]; then
-            echo "Warning: DISCORD_ISSUES_WEBHOOK_URL secret not set, skipping Discord post"
-            cat /tmp/pr_recap.txt
-            exit 0
-          fi
-
-          # Read the recap
-          RECAP_RAW=$(cat /tmp/pr_recap.txt)
-          RECAP_LENGTH=${#RECAP_RAW}
-
-          echo "Recap length: ${RECAP_LENGTH} chars"
-
-          # Function to post a message to Discord
-          post_to_discord() {
-            local msg="$1"
-            local content=$(echo "$msg" | jq -Rs '.')
-            curl -s -H "Content-Type: application/json" \
-                 -X POST \
-                 -d "{\"content\": ${content}}" \
-                 "$DISCORD_WEBHOOK_URL"
-            sleep 1
-          }
-
-          # If under limit, send as single message
-          if [ "$RECAP_LENGTH" -le 1950 ]; then
-            post_to_discord "$RECAP_RAW"
-          else
-            echo "Splitting into multiple messages..."
-            remaining="$RECAP_RAW"
-            while [ ${#remaining} -gt 0 ]; do
-              if [ ${#remaining} -le 1950 ]; then
-                post_to_discord "$remaining"
-                break
-              else
-                chunk="${remaining:0:1900}"
-                last_newline=$(echo "$chunk" | grep -bo $'\n' | tail -1 | cut -d: -f1)
-                if [ -n "$last_newline" ] && [ "$last_newline" -gt 500 ]; then
-                  chunk="${remaining:0:$last_newline}"
-                  remaining="${remaining:$((last_newline+1))}"
-                else
-                  chunk="${remaining:0:1900}"
-                  remaining="${remaining:1900}"
-                fi
-                post_to_discord "$chunk"
-              fi
-            done
-          fi
-
-          echo "Posted daily PR recap to Discord"

.github/workflows/disabled/close-issues.yml.disabled

@@ -0,0 +1,24 @@
+name: close-issues
+
+on:
+  schedule:
+    - cron: "0 2 * * *" # Daily at 2:00 AM
+  workflow_dispatch:
+
+jobs:
+  close:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - name: Close stale issues
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: bun script/github/close-issues.ts

.github/workflows/disabled/compliance-close.yml.disabled

@@ -0,0 +1,95 @@
+name: compliance-close
+
+on:
+  schedule:
+    # Run every 30 minutes to check for expired compliance windows
+    - cron: "*/30 * * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  close-non-compliant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close non-compliant issues and PRs after 2 hours
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const { data: items } = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: 'needs:compliance',
+              state: 'open',
+              per_page: 100,
+            });
+
+            if (items.length === 0) {
+              core.info('No open issues/PRs with needs:compliance label');
+              return;
+            }
+
+            const now = Date.now();
+            const twoHours = 2 * 60 * 60 * 1000;
+
+            for (const item of items) {
+              const isPR = !!item.pull_request;
+              const kind = isPR ? 'PR' : 'issue';
+
+              const { data: comments } = await github.rest.issues.listComments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: item.number,
+              });
+
+              const complianceComment = comments.find(c => c.body.includes('<!-- issue-compliance -->'));
+              if (!complianceComment) continue;
+
+              const commentAge = now - new Date(complianceComment.created_at).getTime();
+              if (commentAge < twoHours) {
+                core.info(`${kind} #${item.number} still within 2-hour window (${Math.round(commentAge / 60000)}m elapsed)`);
+                continue;
+              }
+
+              const closeMessage = isPR
+                ? 'This pull request has been automatically closed because it was not updated to meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md) within the 2-hour window.\n\nFeel free to open a new pull request that follows our guidelines.'
+                : 'This issue has been automatically closed because it was not updated to meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md) within the 2-hour window.\n\nFeel free to open a new issue that follows our issue templates.';
+
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: item.number,
+                body: closeMessage,
+              });
+
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: item.number,
+                  name: 'needs:compliance',
+                });
+              } catch (e) {}
+
+              if (isPR) {
+                await github.rest.pulls.update({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  pull_number: item.number,
+                  state: 'closed',
+                });
+              } else {
+                await github.rest.issues.update({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: item.number,
+                  state: 'closed',
+                  state_reason: 'not_planned',
+                });
+              }
+
+              core.info(`Closed non-compliant ${kind} #${item.number} after 2-hour window`);
+            }

.github/workflows/disabled/duplicate-issues.yml.disabled

@@ -0,0 +1,177 @@
+name: duplicate-issues
+
+on:
+  issues:
+    types: [opened, edited]
+
+jobs:
+  check-duplicates:
+    if: github.event.action == 'opened'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 1
+
+      - uses: ./.github/actions/setup-bun
+
+      - name: Install opencode
+        run: curl -fsSL https://kilo.ai/install | bash
+
+      - name: Check duplicates and compliance
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          KILO_PERMISSION: |
+            {
+              "bash": {
+                "*": "deny",
+                "gh issue*": "allow"
+              },
+              "webfetch": "deny"
+            }
+        run: |
+          opencode run -m opencode/claude-sonnet-4-6 "A new issue has been created:
+
+          Issue number: ${{ github.event.issue.number }}
+
+          Lookup this issue with gh issue view ${{ github.event.issue.number }}.
+
+          You have TWO tasks. Perform both, then post a SINGLE comment (if needed).
+
+          ---
+
+          TASK 1: CONTRIBUTING GUIDELINES COMPLIANCE CHECK
+
+          Check whether the issue follows our contributing guidelines and issue templates.
+
+          This project has three issue templates that every issue MUST use one of:
+
+          1. Bug Report - requires a Description field with real content
+          2. Feature Request - requires a verification checkbox and description, title should start with [FEATURE]:
+          3. Question - requires the Question field with real content
+
+          Additionally check:
+          - No AI-generated walls of text (long, AI-generated descriptions are not acceptable)
+          - The issue has real content, not just template placeholder text left unchanged
+          - Bug reports should include some context about how to reproduce
+          - Feature requests should explain the problem or need
+          - We want to push for having the user provide system description & information
+
+          Do NOT be nitpicky about optional fields. Only flag real problems like: no template used, required fields empty or placeholder text only, obviously AI-generated walls of text, or completely empty/nonsensical content.
+
+          ---
+
+          TASK 2: DUPLICATE CHECK
+
+          Search through existing issues (excluding #${{ github.event.issue.number }}) to find potential duplicates.
+          Consider:
+          1. Similar titles or descriptions
+          2. Same error messages or symptoms
+          3. Related functionality or components
+          4. Similar feature requests
+
+          Additionally, if the issue mentions keybinds, keyboard shortcuts, or key bindings, note the pinned keybinds issue #4997.
+
+          ---
+
+          POSTING YOUR COMMENT:
+
+          Based on your findings, post a SINGLE comment on issue #${{ github.event.issue.number }}. Build the comment as follows:
+
+          If the issue is NOT compliant, start the comment with:
+          <!-- issue-compliance -->
+          Then explain what needs to be fixed and that they have 2 hours to edit the issue before it is automatically closed. Also add the label needs:compliance to the issue using: gh issue edit ${{ github.event.issue.number }} --add-label needs:compliance
+
+          If duplicates were found, include a section about potential duplicates with links.
+
+          If the issue mentions keybinds/keyboard shortcuts, include a note about #4997.
+
+          If the issue IS compliant AND no duplicates were found AND no keybind reference, do NOT comment at all.
+
+          Use this format for the comment:
+
+          [If not compliant:]
+          <!-- issue-compliance -->
+          This issue doesn't fully meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md).
+
+          **What needs to be fixed:**
+          - [specific reasons]
+
+          Please edit this issue to address the above within **2 hours**, or it will be automatically closed.
+
+          [If duplicates found, add:]
+          ---
+          This issue might be a duplicate of existing issues. Please check:
+          - #[issue_number]: [brief description of similarity]
+
+          [If keybind-related, add:]
+          For keybind-related issues, please also check our pinned keybinds documentation: #4997
+
+          [End with if not compliant:]
+          If you believe this was flagged incorrectly, please let a maintainer know.
+
+          Remember: post at most ONE comment combining all findings. If everything is fine, post nothing."
+
+  recheck-compliance:
+    if: github.event.action == 'edited' && contains(github.event.issue.labels.*.name, 'needs:compliance')
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 1
+
+      - uses: ./.github/actions/setup-bun
+
+      - name: Install opencode
+        run: curl -fsSL https://kilo.ai/install | bash
+
+      - name: Recheck compliance
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          KILO_PERMISSION: |
+            {
+              "bash": {
+                "*": "deny",
+                "gh issue*": "allow"
+              },
+              "webfetch": "deny"
+            }
+        run: |
+          opencode run -m opencode/claude-sonnet-4-6 "Issue #${{ github.event.issue.number }} was previously flagged as non-compliant and has been edited.
+
+          Lookup this issue with gh issue view ${{ github.event.issue.number }}.
+
+          Re-check whether the issue now follows our contributing guidelines and issue templates.
+
+          This project has three issue templates that every issue MUST use one of:
+
+          1. Bug Report - requires a Description field with real content
+          2. Feature Request - requires a verification checkbox and description, title should start with [FEATURE]:
+          3. Question - requires the Question field with real content
+
+          Additionally check:
+          - No AI-generated walls of text (long, AI-generated descriptions are not acceptable)
+          - The issue has real content, not just template placeholder text left unchanged
+          - Bug reports should include some context about how to reproduce
+          - Feature requests should explain the problem or need
+          - We want to push for having the user provide system description & information
+
+          Do NOT be nitpicky about optional fields. Only flag real problems like: no template used, required fields empty or placeholder text only, obviously AI-generated walls of text, or completely empty/nonsensical content.
+
+          If the issue is NOW compliant:
+          1. Remove the needs:compliance label: gh issue edit ${{ github.event.issue.number }} --remove-label needs:compliance
+          2. Find and delete the previous compliance comment (the one containing <!-- issue-compliance -->) using: gh api repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments --jq '.[] | select(.body | contains(\"<!-- issue-compliance -->\")) | .id' then delete it with: gh api -X DELETE repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments/{id}
+          3. Post a short comment thanking them for updating the issue.
+
+          If the issue is STILL not compliant:
+          Post a comment explaining what still needs to be fixed. Keep the needs:compliance label."

.github/workflows/disabled/notify-discord.yml.disabled

@@ -12,6 +12,6 @@ jobs:
     runs-on: depot-ubuntu-24.04
     steps:
       - name: Send nicely-formatted embed to Discord
-        uses: SethCohen/github-releases-to-discord@v1
+        uses: SethCohen/github-releases-to-discord@24d166886aee4646d448c8a389ff9e1ebcab3682 # v1.20.0
         with:
           webhook_url: ${{ secrets.DISCORD_WEBHOOK }}

.github/workflows/disabled/pr-management.yml.disabled

@@ -0,0 +1,95 @@
+name: pr-management
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  check-duplicates:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 1
+
+      - name: Check team membership
+        id: team-check
+        run: |
+          LOGIN="${{ github.event.pull_request.user.login }}"
+          if [ "$LOGIN" = "opencode-agent[bot]" ] || grep -qxF "$LOGIN" .github/TEAM_MEMBERS; then
+            echo "is_team=true" >> "$GITHUB_OUTPUT"
+            echo "Skipping: $LOGIN is a team member or bot"
+          else
+            echo "is_team=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Bun
+        if: steps.team-check.outputs.is_team != 'true'
+        uses: ./.github/actions/setup-bun
+
+      - name: Install dependencies
+        if: steps.team-check.outputs.is_team != 'true'
+        run: bun install
+
+      - name: Install opencode
+        if: steps.team-check.outputs.is_team != 'true'
+        run: curl -fsSL https://kilo.ai/install | bash
+
+      - name: Build prompt
+        if: steps.team-check.outputs.is_team != 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          {
+            echo "Check for duplicate PRs related to this new PR:"
+            echo ""
+            echo "CURRENT_PR_NUMBER: $PR_NUMBER"
+            echo ""
+            echo "Title: $(gh pr view "$PR_NUMBER" --json title --jq .title)"
+            echo ""
+            echo "Description:"
+            gh pr view "$PR_NUMBER" --json body --jq .body
+          } > pr_info.txt
+
+      - name: Check for duplicate PRs
+        if: steps.team-check.outputs.is_team != 'true'
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          COMMENT=$(bun script/duplicate-pr.ts -f pr_info.txt "Check the attached file for PR details and search for duplicates")
+
+          if [ "$COMMENT" != "No duplicate PRs found" ]; then
+            gh pr comment "$PR_NUMBER" --body "_The following comment was made by an LLM, it may be inaccurate:_
+
+          $COMMENT"
+          fi
+
+  add-contributor-label:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Add Contributor Label
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const isPR = !!context.payload.pull_request;
+            const issueNumber = isPR ? context.payload.pull_request.number : context.payload.issue.number;
+            const authorAssociation = isPR ? context.payload.pull_request.author_association : context.payload.issue.author_association;
+
+            if (authorAssociation === 'CONTRIBUTOR') {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueNumber,
+                labels: ['contributor']
+              });
+            }

.github/workflows/disabled/pr-standards.yml.disabled

@@ -0,0 +1,351 @@
+name: pr-standards
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize]
+
+jobs:
+  check-standards:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Check PR standards
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const login = pr.user.login;
+
+            // Skip PRs older than Feb 18, 2026 at 6PM EST (Feb 19, 2026 00:00 UTC)
+            const cutoff = new Date('2026-02-19T00:00:00Z');
+            const prCreated = new Date(pr.created_at);
+            if (prCreated < cutoff) {
+              console.log(`Skipping: PR #${pr.number} was created before cutoff (${prCreated.toISOString()})`);
+              return;
+            }
+
+            // Check if author is a team member or bot
+            if (login === 'opencode-agent[bot]') return;
+            const { data: file } = await github.rest.repos.getContent({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              path: '.github/TEAM_MEMBERS',
+              ref: 'dev'
+            });
+            const members = Buffer.from(file.content, 'base64').toString().split('\n').map(l => l.trim()).filter(Boolean);
+            if (members.includes(login)) {
+              console.log(`Skipping: ${login} is a team member`);
+              return;
+            }
+
+            const title = pr.title;
+
+            async function addLabel(label) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                labels: [label]
+              });
+            }
+
+            async function removeLabel(label) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: pr.number,
+                  name: label
+                });
+              } catch (e) {
+                // Label wasn't present, ignore
+              }
+            }
+
+            async function comment(marker, body) {
+              const markerText = `<!-- pr-standards:${marker} -->`;
+              const { data: comments } = await github.rest.issues.listComments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number
+              });
+              
+              const existing = comments.find(c => c.body.includes(markerText));
+              if (existing) return;
+              
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                body: markerText + '\n' + body
+              });
+            }
+
+            // Step 1: Check title format
+            // Matches: feat:, feat(scope):, feat (scope):, etc.
+            const titlePattern = /^(feat|fix|docs|chore|refactor|test)\s*(\([a-zA-Z0-9-]+\))?\s*:/;
+            const hasValidTitle = titlePattern.test(title);
+
+            if (!hasValidTitle) {
+              await addLabel('needs:title');
+              await comment('title', `Hey! Your PR title \`${title}\` doesn't follow conventional commit format.
+
+            Please update it to start with one of:
+            - \`feat:\` or \`feat(scope):\` new feature
+            - \`fix:\` or \`fix(scope):\` bug fix
+            - \`docs:\` or \`docs(scope):\` documentation changes
+            - \`chore:\` or \`chore(scope):\` maintenance tasks
+            - \`refactor:\` or \`refactor(scope):\` code refactoring
+            - \`test:\` or \`test(scope):\` adding or updating tests
+
+            Where \`scope\` is the package name (e.g., \`app\`, \`desktop\`, \`opencode\`).
+
+            See [CONTRIBUTING.md](../blob/dev/CONTRIBUTING.md#pr-titles) for details.`);
+              return;
+            }
+
+            await removeLabel('needs:title');
+
+            // Step 2: Check for linked issue (skip for docs/refactor/feat PRs)
+            const skipIssueCheck = /^(docs|refactor|feat)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
+            if (skipIssueCheck) {
+              await removeLabel('needs:issue');
+              console.log('Skipping issue check for docs/refactor/feat PR');
+              return;
+            }
+            const query = `
+              query($owner: String!, $repo: String!, $number: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequest(number: $number) {
+                    closingIssuesReferences(first: 1) {
+                      totalCount
+                    }
+                  }
+                }
+              }
+            `;
+
+            const result = await github.graphql(query, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              number: pr.number
+            });
+
+            const linkedIssues = result.repository.pullRequest.closingIssuesReferences.totalCount;
+
+            if (linkedIssues === 0) {
+              await addLabel('needs:issue');
+              await comment('issue', `Thanks for your contribution!
+
+            This PR doesn't have a linked issue. All PRs must reference an existing issue.
+
+            Please:
+            1. Open an issue describing the bug/feature (if one doesn't exist)
+            2. Add \`Fixes #<number>\` or \`Closes #<number>\` to this PR description
+
+            See [CONTRIBUTING.md](../blob/dev/CONTRIBUTING.md#issue-first-policy) for details.`);
+              return;
+            }
+
+            await removeLabel('needs:issue');
+            console.log('PR meets all standards');
+
+  check-compliance:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Check PR template compliance
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const login = pr.user.login;
+
+            // Skip PRs older than Feb 18, 2026 at 6PM EST (Feb 19, 2026 00:00 UTC)
+            const cutoff = new Date('2026-02-19T00:00:00Z');
+            const prCreated = new Date(pr.created_at);
+            if (prCreated < cutoff) {
+              console.log(`Skipping: PR #${pr.number} was created before cutoff (${prCreated.toISOString()})`);
+              return;
+            }
+
+            // Check if author is a team member or bot
+            if (login === 'opencode-agent[bot]') return;
+            const { data: file } = await github.rest.repos.getContent({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              path: '.github/TEAM_MEMBERS',
+              ref: 'dev'
+            });
+            const members = Buffer.from(file.content, 'base64').toString().split('\n').map(l => l.trim()).filter(Boolean);
+            if (members.includes(login)) {
+              console.log(`Skipping: ${login} is a team member`);
+              return;
+            }
+
+            const body = pr.body || '';
+            const title = pr.title;
+            const isDocsRefactorOrFeat = /^(docs|refactor|feat)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
+
+            const issues = [];
+
+            // Check: template sections exist
+            const hasWhatSection = /### What does this PR do\?/.test(body);
+            const hasTypeSection = /### Type of change/.test(body);
+            const hasVerifySection = /### How did you verify your code works\?/.test(body);
+            const hasChecklistSection = /### Checklist/.test(body);
+            const hasIssueSection = /### Issue for this PR/.test(body);
+
+            if (!hasWhatSection || !hasTypeSection || !hasVerifySection || !hasChecklistSection || !hasIssueSection) {
+              issues.push('PR description is missing required template sections. Please use the [PR template](../blob/dev/.github/pull_request_template.md).');
+            }
+
+            // Check: "What does this PR do?" has real content (not just placeholder text)
+            if (hasWhatSection) {
+              const whatMatch = body.match(/### What does this PR do\?\s*\n([\s\S]*?)(?=###|$)/);
+              const whatContent = whatMatch ? whatMatch[1].trim() : '';
+              const placeholder = 'Please provide a description of the issue';
+              const onlyPlaceholder = whatContent.includes(placeholder) && whatContent.replace(placeholder, '').replace(/[*\s]/g, '').length < 20;
+              if (!whatContent || onlyPlaceholder) {
+                issues.push('"What does this PR do?" section is empty or only contains placeholder text. Please describe your changes.');
+              }
+            }
+
+            // Check: at least one "Type of change" checkbox is checked
+            if (hasTypeSection) {
+              const typeMatch = body.match(/### Type of change\s*\n([\s\S]*?)(?=###|$)/);
+              const typeContent = typeMatch ? typeMatch[1] : '';
+              const hasCheckedBox = /- \[x\]/i.test(typeContent);
+              if (!hasCheckedBox) {
+                issues.push('No "Type of change" checkbox is checked. Please select at least one.');
+              }
+            }
+
+            // Check: issue reference (skip for docs/refactor/feat)
+            if (!isDocsRefactorOrFeat && hasIssueSection) {
+              const issueMatch = body.match(/### Issue for this PR\s*\n([\s\S]*?)(?=###|$)/);
+              const issueContent = issueMatch ? issueMatch[1].trim() : '';
+              const hasIssueRef = /(closes|fixes|resolves)\s+#\d+/i.test(issueContent) || /#\d+/.test(issueContent);
+              if (!hasIssueRef) {
+                issues.push('No issue referenced. Please add `Closes #<number>` linking to the relevant issue.');
+              }
+            }
+
+            // Check: "How did you verify" has content
+            if (hasVerifySection) {
+              const verifyMatch = body.match(/### How did you verify your code works\?\s*\n([\s\S]*?)(?=###|$)/);
+              const verifyContent = verifyMatch ? verifyMatch[1].trim() : '';
+              if (!verifyContent) {
+                issues.push('"How did you verify your code works?" section is empty. Please explain how you tested.');
+              }
+            }
+
+            // Check: checklist boxes are checked
+            if (hasChecklistSection) {
+              const checklistMatch = body.match(/### Checklist\s*\n([\s\S]*?)(?=###|$)/);
+              const checklistContent = checklistMatch ? checklistMatch[1] : '';
+              const unchecked = (checklistContent.match(/- \[ \]/g) || []).length;
+              const checked = (checklistContent.match(/- \[x\]/gi) || []).length;
+              if (checked < 2) {
+                issues.push('Not all checklist items are checked. Please confirm you have tested locally and have not included unrelated changes.');
+              }
+            }
+
+            // Helper functions
+            async function addLabel(label) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                labels: [label]
+              });
+            }
+
+            async function removeLabel(label) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: pr.number,
+                  name: label
+                });
+              } catch (e) {}
+            }
+
+            const hasComplianceLabel = pr.labels.some(l => l.name === 'needs:compliance');
+
+            if (issues.length > 0) {
+              // Non-compliant
+              if (!hasComplianceLabel) {
+                await addLabel('needs:compliance');
+              }
+
+              const marker = '<!-- issue-compliance -->';
+              const { data: comments } = await github.rest.issues.listComments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number
+              });
+              const existing = comments.find(c => c.body.includes(marker));
+
+              const body_text = `${marker}
+            This PR doesn't fully meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md) and [PR template](../blob/dev/.github/pull_request_template.md).
+
+            **What needs to be fixed:**
+            ${issues.map(i => `- ${i}`).join('\n')}
+
+            Please edit this PR description to address the above within **2 hours**, or it will be automatically closed.
+
+            If you believe this was flagged incorrectly, please let a maintainer know.`;
+
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  comment_id: existing.id,
+                  body: body_text
+                });
+              } else {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: pr.number,
+                  body: body_text
+                });
+              }
+
+              console.log(`PR #${pr.number} is non-compliant: ${issues.join(', ')}`);
+            } else if (hasComplianceLabel) {
+              // Was non-compliant, now fixed
+              await removeLabel('needs:compliance');
+
+              const { data: comments } = await github.rest.issues.listComments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number
+              });
+              const marker = '<!-- issue-compliance -->';
+              const existing = comments.find(c => c.body.includes(marker));
+              if (existing) {
+                await github.rest.issues.deleteComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  comment_id: existing.id
+                });
+              }
+
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                body: 'Thanks for updating your PR! It now meets our contributing guidelines. :+1:'
+              });
+
+              console.log(`PR #${pr.number} is now compliant, label removed`);
+            } else {
+              console.log(`PR #${pr.number} is compliant`);
+            }

.github/workflows/disabled/publish-github-action.yml.disabled

@@ -16,7 +16,7 @@ jobs:
   publish:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           fetch-depth: 0
 

.github/workflows/disabled/release-github-action.yml.disabled

@@ -16,7 +16,7 @@ jobs:
   release:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 

.github/workflows/disabled/review.yml.disabled

@@ -29,7 +29,7 @@ jobs:
           fi
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 1
 
@@ -49,13 +49,13 @@ jobs:
 
       - name: Check PR guidelines compliance
         env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           KILO_PERMISSION: '{ "bash": {  "*": "deny", "gh*": "allow", "gh pr review*": "deny" } }'
           PR_TITLE: ${{ steps.pr-details.outputs.title }}
         run: |
           PR_BODY=$(jq -r .body pr_data.json)
-          opencode run -m anthropic/claude-opus-4-5 "A new pull request has been created: '${PR_TITLE}'
+          opencode run -m opencode/gpt-5.5 --variant medium "A new pull request has been created: '${PR_TITLE}'
 
           <pr-number>
           ${{ steps.pr-number.outputs.number }}

.github/workflows/disabled/stats.yml.disabled

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun

.github/workflows/disabled/storybook.yml.disabled

@@ -0,0 +1,38 @@
+name: storybook
+
+on:
+  push:
+    branches: [dev]
+    paths:
+      - ".github/workflows/storybook.yml"
+      - "package.json"
+      - "bun.lock"
+      - "packages/storybook/**"
+      - "packages/ui/**"
+  pull_request:
+    branches: [dev]
+    paths:
+      - ".github/workflows/storybook.yml"
+      - "package.json"
+      - "bun.lock"
+      - "packages/storybook/**"
+      - "packages/ui/**"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: storybook build
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Build Storybook
+        run: bun --cwd packages/storybook build

.github/workflows/disabled/sync-zed-extension.yml.disabled

@@ -10,7 +10,7 @@ jobs:
     name: Release Zed Extension
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 

.github/workflows/disabled/triage.yml.disabled

@@ -0,0 +1,37 @@
+name: triage
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  triage:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 1
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Install opencode
+        run: curl -fsSL https://kilo.ai/install | bash
+
+      - name: Triage issue
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+        run: |
+          opencode run --agent triage "The following issue was just opened, triage it:
+
+          Title: $ISSUE_TITLE
+
+          $ISSUE_BODY"

.github/workflows/docs-build.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun

.github/workflows/docs-check-links.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6 # kilocode_change
 
       - name: Link Checker
         uses: Kilo-Org/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411

.github/workflows/duplicate-issues.yml

@@ -1,185 +0,0 @@
-name: duplicate-issues
-
-on:
-  issues:
-    types: [opened, edited]
-
-jobs:
-  check-duplicates:
-    if: false # kilocode_change - disabled: not needed in kilocode repo
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: ./.github/actions/setup-bun
-
-      # kilocode_change start
-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
-      # kilocode_change end
-
-      - name: Check duplicates and compliance
-        env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          KILO_PERMISSION: |
-            {
-              "bash": {
-                "*": "deny",
-                "gh issue*": "allow"
-              },
-              "webfetch": "deny"
-            }
-        run: |
-          kilo run -m "kilo/anthropic/claude-haiku-4.5" "A new issue has been created:
-
-          Issue number: ${{ github.event.issue.number }}
-
-          Lookup this issue with gh issue view ${{ github.event.issue.number }}.
-
-          You have TWO tasks. Perform both, then post a SINGLE comment (if needed).
-
-          ---
-
-          TASK 1: CONTRIBUTING GUIDELINES COMPLIANCE CHECK
-
-          Check whether the issue follows our contributing guidelines and issue templates.
-
-          This project has three issue templates that every issue MUST use one of:
-
-          1. Bug Report - requires a Description field with real content
-          2. Feature Request - requires a verification checkbox and description, title should start with [FEATURE]:
-          3. Question - requires the Question field with real content
-
-          Additionally check:
-          - No AI-generated walls of text (long, AI-generated descriptions are not acceptable)
-          - The issue has real content, not just template placeholder text left unchanged
-          - Bug reports should include some context about how to reproduce
-          - Feature requests should explain the problem or need
-          - We want to push for having the user provide system description & information
-
-          Do NOT be nitpicky about optional fields. Only flag real problems like: no template used, required fields empty or placeholder text only, obviously AI-generated walls of text, or completely empty/nonsensical content.
-
-          ---
-
-          TASK 2: DUPLICATE CHECK
-
-          Search through existing issues (excluding #${{ github.event.issue.number }}) to find potential duplicates.
-          Consider:
-          1. Similar titles or descriptions
-          2. Same error messages or symptoms
-          3. Related functionality or components
-          4. Similar feature requests
-
-          Additionally, if the issue mentions keybinds, keyboard shortcuts, or key bindings, note the pinned keybinds issue #4997.
-
-          ---
-
-          POSTING YOUR COMMENT:
-
-          Based on your findings, post a SINGLE comment on issue #${{ github.event.issue.number }}. Build the comment as follows:
-
-          If the issue is NOT compliant, start the comment with:
-          <!-- issue-compliance -->
-          Then explain what needs to be fixed and that they have 2 hours to edit the issue before it is automatically closed. Also add the label needs:compliance to the issue using: gh issue edit ${{ github.event.issue.number }} --add-label needs:compliance
-
-          If duplicates were found, include a section about potential duplicates with links.
-
-          If the issue mentions keybinds/keyboard shortcuts, include a note about #4997.
-
-          If the issue IS compliant AND no duplicates were found AND no keybind reference, do NOT comment at all.
-
-          Use this format for the comment:
-
-          [If not compliant:]
-          <!-- issue-compliance -->
-          This issue doesn't fully meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md).
-
-          **What needs to be fixed:**
-          - [specific reasons]
-
-          Please edit this issue to address the above within **2 hours**, or it will be automatically closed.
-
-          [If duplicates found, add:]
-          ---
-          This issue might be a duplicate of existing issues. Please check:
-          - #[issue_number]: [brief description of similarity]
-
-          [If keybind-related, add:]
-          For keybind-related issues, please also check our pinned keybinds documentation: #4997
-
-          [End with if not compliant:]
-          If you believe this was flagged incorrectly, please let a maintainer know.
-
-          Remember: post at most ONE comment combining all findings. If everything is fine, post nothing."
-
-  recheck-compliance:
-    if: github.event.action == 'edited' && contains(github.event.issue.labels.*.name, 'needs:compliance')
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: ./.github/actions/setup-bun
-
-      # kilocode_change start
-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
-      # kilocode_change end
-
-      - name: Recheck compliance
-        env:
-          # kilocode_change start
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          # kilocode_change end
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          KILO_PERMISSION: |
-            {
-              "bash": {
-                "*": "deny",
-                "gh issue*": "allow"
-              },
-              "webfetch": "deny"
-            }
-        run: |
-          kilo run -m "kilo/anthropic/claude-haiku-4.5" "Issue #${{ github.event.issue.number }} was previously flagged as non-compliant and has been edited.
-
-          Lookup this issue with gh issue view ${{ github.event.issue.number }}.
-
-          Re-check whether the issue now follows our contributing guidelines and issue templates.
-
-          This project has three issue templates that every issue MUST use one of:
-
-          1. Bug Report - requires a Description field with real content
-          2. Feature Request - requires a verification checkbox and description, title should start with [FEATURE]:
-          3. Question - requires the Question field with real content
-
-          Additionally check:
-          - No AI-generated walls of text (long, AI-generated descriptions are not acceptable)
-          - The issue has real content, not just template placeholder text left unchanged
-          - Bug reports should include some context about how to reproduce
-          - Feature requests should explain the problem or need
-          - We want to push for having the user provide system description & information
-
-          Do NOT be nitpicky about optional fields. Only flag real problems like: no template used, required fields empty or placeholder text only, obviously AI-generated walls of text, or completely empty/nonsensical content.
-
-          If the issue is NOW compliant:
-          1. Remove the needs:compliance label: gh issue edit ${{ github.event.issue.number }} --remove-label needs:compliance
-          2. Find and delete the previous compliance comment (the one containing <!-- issue-compliance -->) using: gh api repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments --jq '.[] | select(.body | contains(\"<!-- issue-compliance -->\")) | .id' then delete it with: gh api -X DELETE repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments/{id}
-          3. Post a short comment thanking them for updating the issue.
-
-          If the issue is STILL not compliant:
-          Post a comment explaining what still needs to be fixed. Keep the needs:compliance label."

.github/workflows/generate.yml

@@ -14,7 +14,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
+        # kilocode_change start
+        with:
+          persist-credentials: false
+        # kilocode_change end
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun

.github/workflows/kilo-auto-close.yml

@@ -0,0 +1,366 @@
+# kilocode_change - new file
+name: kilo-auto-close
+
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: "Log actions without closing items"
+        type: boolean
+        default: true
+  schedule:
+    - cron: "0 6 * * *"
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  close:
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - name: Close inactive PRs and issues
+        uses: actions/github-script@v8
+        env:
+          KILO_AUTO_CLOSE_ENABLED: ${{ vars.KILO_AUTO_CLOSE_ENABLED }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const PR_DAYS_INACTIVE = 30
+            const ISSUE_DAYS_INACTIVE = 60
+            const MAX_RETRIES = 3
+
+            // Adaptive delay: fast for small batches, slower for large to respect
+            // GitHub's 80 content-generating requests/minute limit
+            const SMALL_BATCH_THRESHOLD = 10
+            const SMALL_BATCH_DELAY_MS = 1000  // 1s for daily operations (≤10 items)
+            const LARGE_BATCH_DELAY_MS = 2000  // 2s for backlog (>10 items) = ~30 ops/min, well under 80 limit
+
+            const startTime = Date.now()
+            const prCutoff = new Date(Date.now() - PR_DAYS_INACTIVE * 24 * 60 * 60 * 1000)
+            const issueCutoff = new Date(Date.now() - ISSUE_DAYS_INACTIVE * 24 * 60 * 60 * 1000)
+            const { owner, repo } = context.repo
+            const dryRunInput = context.payload.inputs?.dryRun
+            const enabled = process.env.KILO_AUTO_CLOSE_ENABLED === "true"
+            const dryRun = dryRunInput === undefined
+              ? !enabled
+              : dryRunInput !== "false"
+
+            core.info(`Dry run mode: ${dryRun}`)
+            core.info(`PR cutoff date: ${prCutoff.toISOString()}`)
+            core.info(`Issue cutoff date: ${issueCutoff.toISOString()}`)
+
+            function sleep(ms) {
+              return new Promise(resolve => setTimeout(resolve, ms))
+            }
+
+            async function withRetry(fn, description = 'API call') {
+              let lastError
+              for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+                try {
+                  const result = await fn()
+                  return result
+                } catch (error) {
+                  lastError = error
+                  const isRateLimited = error.status === 403 &&
+                    (error.message?.includes('rate limit') || error.message?.includes('secondary'))
+
+                  if (!isRateLimited) {
+                    throw error
+                  }
+
+                  if (attempt === MAX_RETRIES - 1) {
+                    break
+                  }
+
+                  // Parse retry-after header, default to 60 seconds
+                  const retryAfter = error.response?.headers?.['retry-after']
+                    ? parseInt(error.response.headers['retry-after'])
+                    : 60
+
+                  // Exponential backoff: retryAfter * 2^attempt
+                  const backoffMs = retryAfter * 1000 * Math.pow(2, attempt)
+
+                  core.warning(`${description}: Rate limited (attempt ${attempt + 1}/${MAX_RETRIES}). Waiting ${backoffMs / 1000}s before retry...`)
+
+                  await sleep(backoffMs)
+                }
+              }
+              core.error(`${description}: Max retries (${MAX_RETRIES}) exceeded`)
+              throw lastError
+            }
+
+            const query = `
+              query($owner: String!, $repo: String!, $cursor: String) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequests(first: 100, states: OPEN, after: $cursor) {
+                    pageInfo {
+                      hasNextPage
+                      endCursor
+                    }
+                    nodes {
+                      number
+                      title
+                      author {
+                        login
+                      }
+                      createdAt
+                      commits(last: 1) {
+                        nodes {
+                          commit {
+                            committedDate
+                          }
+                        }
+                      }
+                      comments(last: 1) {
+                        nodes {
+                          createdAt
+                        }
+                      }
+                      reviews(last: 1) {
+                        nodes {
+                          createdAt
+                        }
+                      }
+                      reviewThreads(last: 100) {
+                        nodes {
+                          comments(last: 1) {
+                            nodes {
+                              createdAt
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            `
+
+            const allPrs = []
+            let cursor = null
+            let hasNextPage = true
+            let pageCount = 0
+
+            while (hasNextPage) {
+              pageCount++
+              core.info(`Fetching page ${pageCount} of open PRs...`)
+
+              const result = await withRetry(
+                () => github.graphql(query, { owner, repo, cursor }),
+                `GraphQL page ${pageCount}`
+              )
+
+              allPrs.push(...result.repository.pullRequests.nodes)
+              hasNextPage = result.repository.pullRequests.pageInfo.hasNextPage
+              cursor = result.repository.pullRequests.pageInfo.endCursor
+
+              core.info(`Page ${pageCount}: fetched ${result.repository.pullRequests.nodes.length} PRs (total: ${allPrs.length})`)
+
+              // Delay between pagination requests (use small batch delay for reads)
+              if (hasNextPage) {
+                await sleep(SMALL_BATCH_DELAY_MS)
+              }
+            }
+
+            core.info(`Found ${allPrs.length} open pull requests`)
+
+            function entry(source, date) {
+              if (!date) return null
+
+              return { source, date: new Date(date) }
+            }
+
+            function latest(items) {
+              return items.filter(Boolean).sort((a, b) => b.date.getTime() - a.date.getTime())[0]
+            }
+
+            const stalePrs = allPrs.flatMap((pr) => {
+              const activity = latest([
+                entry("created", pr.createdAt),
+                entry("commit", pr.commits.nodes[0]?.commit.committedDate),
+                entry("comment", pr.comments.nodes[0]?.createdAt),
+                entry("review", pr.reviews.nodes[0]?.createdAt),
+                ...pr.reviewThreads.nodes.map((t) => entry("review comment", t.comments.nodes[0]?.createdAt)),
+              ])
+              const text = activity
+                ? `${activity.date.toISOString()} via ${activity.source}`
+                : "unknown"
+
+              if (!activity || activity.date > prCutoff) {
+                core.info(`PR #${pr.number} is fresh (last activity: ${text})`)
+                return []
+              }
+
+              core.info(`PR #${pr.number} is STALE (last activity: ${text})`)
+              return [{ ...pr, activity }]
+            })
+
+            core.info(`Found ${stalePrs.length} stale pull requests`)
+
+            const prDelayMs = stalePrs.length > SMALL_BATCH_THRESHOLD
+              ? LARGE_BATCH_DELAY_MS
+              : SMALL_BATCH_DELAY_MS
+
+            core.info(`Using ${prDelayMs}ms delay between PR operations (${stalePrs.length > SMALL_BATCH_THRESHOLD ? 'large' : 'small'} batch mode)`)
+
+            let closedPrCount = 0
+            let skippedPrCount = 0
+
+            for (const pr of stalePrs) {
+              const issue_number = pr.number
+              const closeComment = `To stay organized pull requests are automatically closed after ${PR_DAYS_INACTIVE} days of inactivity. If the pull request is still relevant please reopen it or create a fresh new one.`
+
+              if (dryRun) {
+                core.info(`[dry-run] Would close PR #${issue_number} from ${pr.author?.login || 'unknown'} (last activity: ${pr.activity.date.toISOString()} via ${pr.activity.source}): ${pr.title}`)
+                continue
+              }
+
+              try {
+                // Add comment
+                await withRetry(
+                  () => github.rest.issues.createComment({
+                    owner,
+                    repo,
+                    issue_number,
+                    body: closeComment,
+                  }),
+                  `Comment on PR #${issue_number}`
+                )
+
+                // Close PR
+                await withRetry(
+                  () => github.rest.pulls.update({
+                    owner,
+                    repo,
+                    pull_number: issue_number,
+                    state: "closed",
+                  }),
+                  `Close PR #${issue_number}`
+                )
+
+                closedPrCount++
+                core.info(`Closed PR #${issue_number} from ${pr.author?.login || 'unknown'} (last activity: ${pr.activity.date.toISOString()} via ${pr.activity.source}): ${pr.title}`)
+
+                // Delay before processing next PR
+                await sleep(prDelayMs)
+              } catch (error) {
+                skippedPrCount++
+                core.error(`Failed to close PR #${issue_number}: ${error.message}`)
+              }
+            }
+
+            let page = 1
+            let stop = false
+            const staleIssues = []
+
+            while (!stop) {
+              core.info(`Fetching page ${page} of open issues...`)
+
+              const result = await withRetry(
+                () => github.rest.issues.listForRepo({
+                  owner,
+                  repo,
+                  state: "open",
+                  sort: "updated",
+                  direction: "asc",
+                  per_page: 100,
+                  page,
+                }),
+                `Issues page ${page}`
+              )
+
+              if (!result.data.length) {
+                break
+              }
+
+              core.info(`Page ${page}: fetched ${result.data.length} issues`)
+
+              for (const issue of result.data) {
+                const updated = new Date(issue.updated_at)
+
+                if (updated >= issueCutoff) {
+                  core.info(`Found fresh issue/PR #${issue.number} (${updated.toISOString()}), stopping issue scan`)
+                  stop = true
+                  break
+                }
+
+                if (issue.pull_request) {
+                  core.info(`Skipping PR #${issue.number} in issue scan`)
+                  continue
+                }
+
+                staleIssues.push({ ...issue, activity: updated })
+              }
+
+              if (!stop) {
+                page++
+                await sleep(SMALL_BATCH_DELAY_MS)
+              }
+            }
+
+            core.info(`Found ${staleIssues.length} stale issues`)
+
+            const issueDelayMs = staleIssues.length > SMALL_BATCH_THRESHOLD
+              ? LARGE_BATCH_DELAY_MS
+              : SMALL_BATCH_DELAY_MS
+
+            core.info(`Using ${issueDelayMs}ms delay between issue operations (${staleIssues.length > SMALL_BATCH_THRESHOLD ? 'large' : 'small'} batch mode)`)
+
+            let closedIssueCount = 0
+            let skippedIssueCount = 0
+
+            for (const issue of staleIssues) {
+              const closeComment = `To stay organized issues are automatically closed after ${ISSUE_DAYS_INACTIVE} days of no activity. If the issue is still relevant please reopen it or create a fresh new one.`
+
+              if (dryRun) {
+                core.info(`[dry-run] Would close issue #${issue.number} (last activity: ${issue.activity.toISOString()} via updated): ${issue.title}`)
+                continue
+              }
+
+              try {
+                await withRetry(
+                  () => github.rest.issues.createComment({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    body: closeComment,
+                  }),
+                  `Comment on issue #${issue.number}`
+                )
+
+                await withRetry(
+                  () => github.rest.issues.update({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    state: "closed",
+                    state_reason: "not_planned",
+                  }),
+                  `Close issue #${issue.number}`
+                )
+
+                closedIssueCount++
+                core.info(`Closed issue #${issue.number} (last activity: ${issue.activity.toISOString()} via updated): ${issue.title}`)
+
+                await sleep(issueDelayMs)
+              } catch (error) {
+                skippedIssueCount++
+                core.error(`Failed to close issue #${issue.number}: ${error.message}`)
+              }
+            }
+
+            const elapsed = Math.round((Date.now() - startTime) / 1000)
+            core.info(`\n========== Summary ==========`)
+            core.info(`Total open PRs found: ${allPrs.length}`)
+            core.info(`Stale PRs identified: ${stalePrs.length}`)
+            core.info(`PRs closed: ${closedPrCount}`)
+            core.info(`PRs skipped (errors): ${skippedPrCount}`)
+            core.info(`Stale issues identified: ${staleIssues.length}`)
+            core.info(`Issues closed: ${closedIssueCount}`)
+            core.info(`Issues skipped (errors): ${skippedIssueCount}`)
+            core.info(`Elapsed time: ${elapsed}s`)
+            core.info(`=============================`)

.github/workflows/nix-eval.yml

@@ -21,10 +21,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@v34
+        uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
 
       - name: Evaluate flake outputs (all systems)
         run: |
@@ -40,8 +40,6 @@ jobs:
 
           SYSTEMS="x86_64-linux aarch64-linux x86_64-darwin aarch64-darwin"
           PACKAGES="kilo"
-          # TODO: move 'desktop' to PACKAGES when #11755 is fixed
-          OPTIONAL_PACKAGES="desktop"
 
           echo ""
           echo "=== Evaluating packages for all systems ==="
@@ -61,23 +59,6 @@ jobs:
             done
           done
 
-          echo ""
-          echo "=== Evaluating optional packages ==="
-          for system in $SYSTEMS; do
-            echo ""
-            echo "--- $system ---"
-            for pkg in $OPTIONAL_PACKAGES; do
-              printf "  %s: " "$pkg"
-              if output=$(nix eval ".#packages.$system.$pkg.drvPath" --raw 2>&1); then
-                echo "✓"
-              else
-                echo "✗"
-                echo "::warning::Evaluation failed for packages.$system.$pkg"
-                echo "$output"
-              fi
-            done
-          done
-
           echo ""
           echo "=== Evaluating devShells for all systems ==="
           for system in $SYSTEMS; do

.github/workflows/nix-hashes.yml

@@ -42,10 +42,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@v34
+        uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
 
       - name: Compute node_modules hash
         id: hash
@@ -73,7 +73,7 @@ jobs:
           echo "Computed hash for ${SYSTEM}: $HASH"
 
       - name: Upload hash
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7 # kilocode_change
         with:
           name: hash-${{ matrix.system }}
           path: hash.txt
@@ -86,7 +86,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -106,7 +106,7 @@ jobs:
           git pull --rebase --autostash origin "$GITHUB_REF_NAME"
 
       - name: Download hash artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8 # kilocode_change
         with:
           path: hashes
           pattern: hash-*

.github/workflows/pr-management.yml

@@ -1,113 +0,0 @@
-name: pr-management
-
-on:
-  pull_request_target:
-    types: [opened]
-
-jobs:
-  # kilocode_change start
-  check-author:
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    uses: ./.github/workflows/check-org-member.yml
-    with:
-      username: ${{ github.event.pull_request.user.login }}
-    secrets:
-      kilo-maintainer-app-id: ${{ secrets.KILO_MAINTAINER_APP_ID }}
-      kilo-maintainer-app-secret: ${{ secrets.KILO_MAINTAINER_APP_SECRET }}
-
-  check-duplicates:
-    needs: check-author
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    # kilocode_change end
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Check team membership
-        id: team-check
-        run: |
-          LOGIN="${{ github.event.pull_request.user.login }}"
-          if [ "$LOGIN" = "opencode-agent[bot]" ] || grep -qxF "$LOGIN" .github/TEAM_MEMBERS; then
-            echo "is_team=true" >> "$GITHUB_OUTPUT"
-            echo "Skipping: $LOGIN is a team member or bot"
-          else
-            echo "is_team=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Setup Bun
-        if: steps.team-check.outputs.is_team != 'true'
-        uses: ./.github/actions/setup-bun
-
-      - name: Install dependencies
-        if: steps.team-check.outputs.is_team != 'true'
-        run: bun install
-
-      # kilocode_change start
-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
-      # kilocode_change end
-
-      - name: Build prompt
-        if: steps.team-check.outputs.is_team != 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          {
-            echo "Check for duplicate PRs related to this new PR:"
-            echo ""
-            echo "CURRENT_PR_NUMBER: $PR_NUMBER"
-            echo ""
-            echo "Title: $(gh pr view "$PR_NUMBER" --json title --jq .title)"
-            echo ""
-            echo "Description:"
-            gh pr view "$PR_NUMBER" --json body --jq .body
-          } > pr_info.txt
-
-      - name: Check for duplicate PRs
-        if: steps.team-check.outputs.is_team != 'true'
-        env:
-          # kilocode_change start
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          # kilocode_change end
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          COMMENT=$(bun script/duplicate-pr.ts -f pr_info.txt "Check the attached file for PR details and search for duplicates")
-
-          if [ "$COMMENT" != "No duplicate PRs found" ]; then
-            gh pr comment "$PR_NUMBER" --body "_The following comment was made by an LLM, it may be inaccurate:_
-
-          $COMMENT"
-          fi
-
-  add-contributor-label:
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    runs-on: blacksmith-2vcpu-ubuntu-2404 # kilocode_change
-    permissions:
-      pull-requests: write
-      issues: write
-    steps:
-      - name: Add Contributor Label
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const isPR = !!context.payload.pull_request;
-            const issueNumber = isPR ? context.payload.pull_request.number : context.payload.issue.number;
-            const authorAssociation = isPR ? context.payload.pull_request.author_association : context.payload.issue.author_association;
-
-            if (authorAssociation === 'CONTRIBUTOR') {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issueNumber,
-                labels: ['contributor']
-              });
-            }

.github/workflows/pr-standards.yml

@@ -1,340 +0,0 @@
-name: pr-standards
-
-on:
-  pull_request_target:
-    types: [opened, edited, synchronize]
-
-jobs:
-  # kilocode_change start
-  check-author:
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    uses: ./.github/workflows/check-org-member.yml
-    with:
-      username: ${{ github.event.pull_request.user.login }}
-    secrets:
-      kilo-maintainer-app-id: ${{ secrets.KILO_MAINTAINER_APP_ID }}
-      kilo-maintainer-app-secret: ${{ secrets.KILO_MAINTAINER_APP_SECRET }}
-
-  check-standards:
-    needs: check-author
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    # kilocode_change end
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Check PR standards
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const pr = context.payload.pull_request;
-            const title = pr.title;
-
-            async function addLabel(label) {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                labels: [label]
-              });
-            }
-
-            async function removeLabel(label) {
-              try {
-                await github.rest.issues.removeLabel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: pr.number,
-                  name: label
-                });
-              } catch (e) {
-                // Label wasn't present, ignore
-              }
-            }
-
-            async function comment(marker, body) {
-              const markerText = `<!-- pr-standards:${marker} -->`;
-              const { data: comments } = await github.rest.issues.listComments({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number
-              });
-
-              const existing = comments.find(c => c.body.includes(markerText));
-              if (existing) return;
-
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                body: markerText + '\n' + body
-              });
-            }
-
-            // Step 1: Check title format
-            // Matches: feat:, feat(scope):, feat (scope):, etc.
-            const titlePattern = /^(feat|fix|docs|chore|refactor|test)\s*(\([a-zA-Z0-9-]+\))?\s*:/;
-            const hasValidTitle = titlePattern.test(title);
-
-            if (!hasValidTitle) {
-              await addLabel('needs:title');
-              await comment('title', `Hey! Your PR title \`${title}\` doesn't follow conventional commit format.
-
-            Please update it to start with one of:
-            - \`feat:\` or \`feat(scope):\` new feature
-            - \`fix:\` or \`fix(scope):\` bug fix
-            - \`docs:\` or \`docs(scope):\` documentation changes
-            - \`chore:\` or \`chore(scope):\` maintenance tasks
-            - \`refactor:\` or \`refactor(scope):\` code refactoring
-            - \`test:\` or \`test(scope):\` adding or updating tests
-
-            Where \`scope\` is the package name (e.g., \`app\`, \`desktop\`, \`kilo\`).
-
-            See [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md#pr-titles) for details.`);
-              return;
-            }
-
-            await removeLabel('needs:title');
-
-            // Step 2: Check for linked issue (skip for docs/refactor/feat PRs)
-            const skipIssueCheck = /^(docs|refactor|feat)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
-            if (skipIssueCheck) {
-              await removeLabel('needs:issue');
-              console.log('Skipping issue check for docs/refactor/feat PR');
-              return;
-            }
-            const query = `
-              query($owner: String!, $repo: String!, $number: Int!) {
-                repository(owner: $owner, name: $repo) {
-                  pullRequest(number: $number) {
-                    closingIssuesReferences(first: 1) {
-                      totalCount
-                    }
-                  }
-                }
-              }
-            `;
-
-            const result = await github.graphql(query, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              number: pr.number
-            });
-
-            const linkedIssues = result.repository.pullRequest.closingIssuesReferences.totalCount;
-
-            if (linkedIssues === 0) {
-              await addLabel('needs:issue');
-              await comment('issue', `Thanks for your contribution!
-
-            This PR doesn't have a linked issue. All PRs must reference an existing issue.
-
-            Please:
-            1. Open an issue describing the bug/feature (if one doesn't exist)
-            2. Add \`Fixes #<number>\` or \`Closes #<number>\` to this PR description
-
-            See [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md#issue-first-policy) for details.`);
-              return;
-            }
-
-            await removeLabel('needs:issue');
-            console.log('PR meets all standards');
-
-  check-compliance:
-    if: github.repository == 'Kilo-Org/kilocode' && false # kilocode_change - disabled: not needed in kilocode repo
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Check PR template compliance
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const pr = context.payload.pull_request;
-            const login = pr.user.login;
-
-            // Skip PRs older than Feb 18, 2026 at 6PM EST (Feb 19, 2026 00:00 UTC)
-            const cutoff = new Date('2026-02-19T00:00:00Z');
-            const prCreated = new Date(pr.created_at);
-            if (prCreated < cutoff) {
-              console.log(`Skipping: PR #${pr.number} was created before cutoff (${prCreated.toISOString()})`);
-              return;
-            }
-
-            // Check if author is a team member or bot
-            if (login === 'opencode-agent[bot]') return;
-            const { data: file } = await github.rest.repos.getContent({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              path: '.github/TEAM_MEMBERS',
-              ref: 'dev'
-            });
-            const members = Buffer.from(file.content, 'base64').toString().split('\n').map(l => l.trim()).filter(Boolean);
-            if (members.includes(login)) {
-              console.log(`Skipping: ${login} is a team member`);
-              return;
-            }
-
-            const body = pr.body || '';
-            const title = pr.title;
-            const isDocsRefactorOrFeat = /^(docs|refactor|feat)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
-
-            const issues = [];
-
-            // Check: template sections exist
-            const hasWhatSection = /### What does this PR do\?/.test(body);
-            const hasTypeSection = /### Type of change/.test(body);
-            const hasVerifySection = /### How did you verify your code works\?/.test(body);
-            const hasChecklistSection = /### Checklist/.test(body);
-            const hasIssueSection = /### Issue for this PR/.test(body);
-
-            if (!hasWhatSection || !hasTypeSection || !hasVerifySection || !hasChecklistSection || !hasIssueSection) {
-              issues.push('PR description is missing required template sections. Please use the [PR template](../blob/dev/.github/pull_request_template.md).');
-            }
-
-            // Check: "What does this PR do?" has real content (not just placeholder text)
-            if (hasWhatSection) {
-              const whatMatch = body.match(/### What does this PR do\?\s*\n([\s\S]*?)(?=###|$)/);
-              const whatContent = whatMatch ? whatMatch[1].trim() : '';
-              const placeholder = 'Please provide a description of the issue';
-              const onlyPlaceholder = whatContent.includes(placeholder) && whatContent.replace(placeholder, '').replace(/[*\s]/g, '').length < 20;
-              if (!whatContent || onlyPlaceholder) {
-                issues.push('"What does this PR do?" section is empty or only contains placeholder text. Please describe your changes.');
-              }
-            }
-
-            // Check: at least one "Type of change" checkbox is checked
-            if (hasTypeSection) {
-              const typeMatch = body.match(/### Type of change\s*\n([\s\S]*?)(?=###|$)/);
-              const typeContent = typeMatch ? typeMatch[1] : '';
-              const hasCheckedBox = /- \[x\]/i.test(typeContent);
-              if (!hasCheckedBox) {
-                issues.push('No "Type of change" checkbox is checked. Please select at least one.');
-              }
-            }
-
-            // Check: issue reference (skip for docs/refactor/feat)
-            if (!isDocsRefactorOrFeat && hasIssueSection) {
-              const issueMatch = body.match(/### Issue for this PR\s*\n([\s\S]*?)(?=###|$)/);
-              const issueContent = issueMatch ? issueMatch[1].trim() : '';
-              const hasIssueRef = /(closes|fixes|resolves)\s+#\d+/i.test(issueContent) || /#\d+/.test(issueContent);
-              if (!hasIssueRef) {
-                issues.push('No issue referenced. Please add `Closes #<number>` linking to the relevant issue.');
-              }
-            }
-
-            // Check: "How did you verify" has content
-            if (hasVerifySection) {
-              const verifyMatch = body.match(/### How did you verify your code works\?\s*\n([\s\S]*?)(?=###|$)/);
-              const verifyContent = verifyMatch ? verifyMatch[1].trim() : '';
-              if (!verifyContent) {
-                issues.push('"How did you verify your code works?" section is empty. Please explain how you tested.');
-              }
-            }
-
-            // Check: checklist boxes are checked
-            if (hasChecklistSection) {
-              const checklistMatch = body.match(/### Checklist\s*\n([\s\S]*?)(?=###|$)/);
-              const checklistContent = checklistMatch ? checklistMatch[1] : '';
-              const unchecked = (checklistContent.match(/- \[ \]/g) || []).length;
-              const checked = (checklistContent.match(/- \[x\]/gi) || []).length;
-              if (checked < 2) {
-                issues.push('Not all checklist items are checked. Please confirm you have tested locally and have not included unrelated changes.');
-              }
-            }
-
-            // Helper functions
-            async function addLabel(label) {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                labels: [label]
-              });
-            }
-
-            async function removeLabel(label) {
-              try {
-                await github.rest.issues.removeLabel({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: pr.number,
-                  name: label
-                });
-              } catch (e) {}
-            }
-
-            const hasComplianceLabel = pr.labels.some(l => l.name === 'needs:compliance');
-
-            if (issues.length > 0) {
-              // Non-compliant
-              if (!hasComplianceLabel) {
-                await addLabel('needs:compliance');
-              }
-
-              const marker = '<!-- issue-compliance -->';
-              const { data: comments } = await github.rest.issues.listComments({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number
-              });
-              const existing = comments.find(c => c.body.includes(marker));
-
-              const body_text = `${marker}
-            This PR doesn't fully meet our [contributing guidelines](../blob/dev/CONTRIBUTING.md) and [PR template](../blob/dev/.github/pull_request_template.md).
-
-            **What needs to be fixed:**
-            ${issues.map(i => `- ${i}`).join('\n')}
-
-            Please edit this PR description to address the above within **2 hours**, or it will be automatically closed.
-
-            If you believe this was flagged incorrectly, please let a maintainer know.`;
-
-              if (existing) {
-                await github.rest.issues.updateComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: existing.id,
-                  body: body_text
-                });
-              } else {
-                await github.rest.issues.createComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: pr.number,
-                  body: body_text
-                });
-              }
-
-              console.log(`PR #${pr.number} is non-compliant: ${issues.join(', ')}`);
-            } else if (hasComplianceLabel) {
-              // Was non-compliant, now fixed
-              await removeLabel('needs:compliance');
-
-              const { data: comments } = await github.rest.issues.listComments({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number
-              });
-              const marker = '<!-- issue-compliance -->';
-              const existing = comments.find(c => c.body.includes(marker));
-              if (existing) {
-                await github.rest.issues.deleteComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: existing.id
-                });
-              }
-
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: pr.number,
-                body: 'Thanks for updating your PR! It now meets our contributing guidelines. :+1:'
-              });
-
-              console.log(`PR #${pr.number} is now compliant, label removed`);
-            } else {
-              console.log(`PR #${pr.number} is compliant`);
-            }

.github/workflows/prepare-jetbrains-release.yml

@@ -0,0 +1,64 @@
+# kilocode_change - new file
+name: prepare-jetbrains-release
+
+on:
+  workflow_dispatch:
+    inputs:
+      kind:
+        description: "Release kind"
+        required: true
+        type: choice
+        options:
+          - rc
+          - stable
+      version:
+        description: "Version, e.g. 7.3.13-rc.1 or 7.3.13"
+        required: true
+        type: string
+      from_tag:
+        description: "Optional previous tag for changelog range"
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: prepare-jetbrains-release-${{ inputs.version }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Setup Git Committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          kilo-maintainer-app-id: ${{ secrets.KILO_MAINTAINER_APP_ID }}
+          kilo-maintainer-app-secret: ${{ secrets.KILO_MAINTAINER_APP_SECRET }}
+
+      - name: Create release tag and PR
+        run: |
+          args=(--kind "$KIND" --version "$VERSION")
+          if [[ -n "$FROM_TAG" ]]; then
+            args+=(--from-tag "$FROM_TAG")
+          fi
+          bun script/jetbrains-release-pr.ts "${args[@]}"
+        env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+          GH_REPO: ${{ github.repository }}
+          KIND: ${{ inputs.kind }}
+          VERSION: ${{ inputs.version }}
+          FROM_TAG: ${{ inputs.from_tag }}

.github/workflows/publish-jetbrains.yml

@@ -0,0 +1,194 @@
+# kilocode_change - new file
+name: publish-jetbrains
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+concurrency:
+  group: publish-jetbrains-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  publish:
+    if: >-
+      github.repository == 'Kilo-Org/kilocode' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, 'jetbrains/release/') &&
+      contains(github.event.pull_request.labels.*.name, 'jetbrains-release') &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    steps:
+      - name: Checkout merged release PR
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+
+      - name: Setup Bun for validation
+        uses: ./.github/actions/setup-bun
+
+      - name: Validate release PR and tag
+        id: release
+        run: bun script/jetbrains-release-validate.ts --pr "$PR_NUMBER"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+
+      - name: Save reviewed release metadata
+        run: |
+          cp packages/kilo-jetbrains/CHANGELOG.md "$RUNNER_TEMP/jetbrains-CHANGELOG.md"
+          cp packages/kilo-jetbrains/gradle.properties "$RUNNER_TEMP/jetbrains-gradle.properties"
+
+      - name: Checkout release tag
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.release.outputs.tag }}
+
+      - name: Restore reviewed release metadata
+        run: |
+          cp "$RUNNER_TEMP/jetbrains-CHANGELOG.md" packages/kilo-jetbrains/CHANGELOG.md
+          cp "$RUNNER_TEMP/jetbrains-gradle.properties" packages/kilo-jetbrains/gradle.properties
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Install build tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y patchelf zip
+
+      - name: Validate publishing secrets
+        run: |
+          missing=0
+          for name in JETBRAINS_MARKETPLACE_TOKEN JETBRAINS_CERTIFICATE_CHAIN JETBRAINS_PRIVATE_KEY JETBRAINS_PRIVATE_KEY_PASSWORD; do
+            if [[ -z "${!name}" ]]; then
+              echo "Missing required secret: $name" >&2
+              missing=1
+            fi
+          done
+          exit "$missing"
+        env:
+          JETBRAINS_MARKETPLACE_TOKEN: ${{ secrets.JETBRAINS_MARKETPLACE_TOKEN }}
+          JETBRAINS_CERTIFICATE_CHAIN: ${{ secrets.JETBRAINS_CERTIFICATE_CHAIN }}
+          JETBRAINS_PRIVATE_KEY: ${{ secrets.JETBRAINS_PRIVATE_KEY }}
+          JETBRAINS_PRIVATE_KEY_PASSWORD: ${{ secrets.JETBRAINS_PRIVATE_KEY_PASSWORD }}
+
+      - name: Prepare CLI resources
+        working-directory: packages/kilo-jetbrains
+        run: bun script/build.ts --production --prepare-cli
+        env:
+          KILO_VERSION: ${{ steps.release.outputs.version }}
+          KILO_CHANNEL: ${{ steps.release.outputs.cli_channel }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+
+      - name: Verify plugin
+        working-directory: packages/kilo-jetbrains
+        run: ./gradlew verifyPlugin -Pproduction=true -Pkilo.channel="$CHANNEL"
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          CHANNEL: ${{ steps.release.outputs.marketplace_channel }}
+
+      - name: Render release notes
+        working-directory: packages/kilo-jetbrains
+        run: |
+          if ! grep -Fq "## [$VERSION]" CHANGELOG.md; then
+            echo "Missing packages/kilo-jetbrains/CHANGELOG.md entry for $VERSION. Review and merge a release PR before publishing." >&2
+            exit 1
+          fi
+          ./gradlew getChangelog --project-version "$VERSION" --no-header --no-empty-sections --output-file=build/release-notes.md
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+
+      - name: Publish to JetBrains Marketplace
+        working-directory: packages/kilo-jetbrains
+        run: ./gradlew publishPlugin -Pproduction=true -Pkilo.channel="$CHANNEL"
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          CHANNEL: ${{ steps.release.outputs.marketplace_channel }}
+          JETBRAINS_MARKETPLACE_TOKEN: ${{ secrets.JETBRAINS_MARKETPLACE_TOKEN }}
+          JETBRAINS_CERTIFICATE_CHAIN: ${{ secrets.JETBRAINS_CERTIFICATE_CHAIN }}
+          JETBRAINS_PRIVATE_KEY: ${{ secrets.JETBRAINS_PRIVATE_KEY }}
+          JETBRAINS_PRIVATE_KEY_PASSWORD: ${{ secrets.JETBRAINS_PRIVATE_KEY_PASSWORD }}
+
+      - name: Resolve plugin archive
+        id: archive
+        run: |
+          mapfile -t signed < <(compgen -G "packages/kilo-jetbrains/build/distributions/*-signed.zip")
+          if [[ "${#signed[@]}" -eq 1 ]]; then
+            echo "path=${signed[0]}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if [[ "${#signed[@]}" -gt 1 ]]; then
+            echo "Expected exactly one signed JetBrains plugin ZIP, found ${#signed[@]}." >&2
+            printf '%s\n' "${signed[@]}" >&2
+            exit 1
+          fi
+
+          mapfile -t files < <(compgen -G "packages/kilo-jetbrains/build/distributions/*.zip")
+          if [[ "${#files[@]}" -ne 1 ]]; then
+            echo "Expected exactly one JetBrains plugin ZIP, found ${#files[@]}." >&2
+            printf '%s\n' "${files[@]}" >&2
+            exit 1
+          fi
+          echo "path=${files[0]}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload to GitHub Release
+        run: |
+          tag="$TAG"
+          title="JetBrains $VERSION"
+          flags=(--title "$title" --notes-file "$NOTES")
+          if [[ "$KIND" == "rc" ]]; then
+            flags+=(--prerelease)
+          fi
+          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$tag" "$ARCHIVE" --clobber --repo "$GITHUB_REPOSITORY"
+            gh release edit "$tag" "${flags[@]}" --repo "$GITHUB_REPOSITORY"
+            exit 0
+          fi
+          gh release create "$tag" "$ARCHIVE" "${flags[@]}" --repo "$GITHUB_REPOSITORY"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.release.outputs.tag }}
+          VERSION: ${{ steps.release.outputs.version }}
+          KIND: ${{ steps.release.outputs.kind }}
+          ARCHIVE: ${{ steps.archive.outputs.path }}
+          NOTES: packages/kilo-jetbrains/build/release-notes.md
+
+      - name: Upload workflow artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kilo-jetbrains-${{ steps.release.outputs.version }}
+          path: packages/kilo-jetbrains/build/distributions/*.zip
+          if-no-files-found: ignore

.github/workflows/publish.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'Kilo-Org/kilocode'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6 # kilocode_change
         with:
           fetch-depth: 0
 
@@ -78,7 +78,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'Kilo-Org/kilocode'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6 # kilocode_change
         with:
           fetch-tags: true
 
@@ -99,34 +99,214 @@ jobs:
       # download-artifact@v4's streaming unzip is CPU-bound and processes entries one by one;
       # collapsing ~480 files into one tar cuts build-vscode download from >30m to seconds.
       # zstd compresses the wasms (~4x) and leaves the already-compact binaries alone, for
-      # ~1 GB artifact. compression-level: 0 on the outer zip avoids double-compression.
-      # zstd + GNU tar are preinstalled on both github-hosted and blacksmith ubuntu-2404.
-      # See actions/upload-artifact#36, actions/toolkit#1533.
+      # ~1 GB artifact. upload-artifact@v7's `archive: false` skips the zip wrapper entirely
+      # so the tarball travels as-is (download-artifact@v8 auto-detects via Content-Type).
+      # With `archive: false` the `name:` input is ignored; the artifact is named after the
+      # file (kilo-cli.tar.zst). zstd + GNU tar are preinstalled on both github-hosted and
+      # blacksmith ubuntu-2404. See actions/upload-artifact#36, actions/toolkit#1533.
       - name: Pack CLI dist into tar.zst
         run: |
           find packages/opencode/dist -name '*.map' -delete
           tar --zstd -cf /tmp/kilo-cli.tar.zst -C packages/opencode/dist .
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
-          name: kilo-cli
           path: /tmp/kilo-cli.tar.zst
-          compression-level: 0
+          archive: false
       # kilocode_change end
 
     outputs:
       version: ${{ needs.version.outputs.version }}
 
-  build-vscode:
+  # kilocode_change start - execute supported Unix CLI binaries before packaging VSIX artifacts
+  validate-cli-unix:
+    name: Validate CLI (${{ matrix.target }})
     needs: build-cli
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: darwin-arm64
+            runner: macos-15
+            uname: arm64
+            package: "@kilocode/cli-darwin-arm64"
+            mode: host
+          - target: darwin-x64
+            runner: macos-15-intel
+            uname: x86_64
+            package: "@kilocode/cli-darwin-x64"
+            mode: host
+          - target: linux-arm64
+            runner: ubuntu-24.04-arm
+            uname: aarch64
+            package: "@kilocode/cli-linux-arm64"
+            mode: host
+          - target: linux-x64
+            runner: ubuntu-24.04
+            uname: x86_64
+            package: "@kilocode/cli-linux-x64"
+            mode: host
+          - target: alpine-arm64
+            runner: ubuntu-24.04-arm
+            uname: aarch64
+            package: "@kilocode/cli-linux-arm64-musl"
+            mode: alpine
+            platform: linux/arm64
+          - target: alpine-x64
+            runner: ubuntu-24.04
+            uname: x86_64
+            package: "@kilocode/cli-linux-x64-musl"
+            mode: alpine
+            platform: linux/amd64
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: kilo-cli.tar.zst
+          path: /tmp
+          skip-decompress: true
+
+      - name: Unpack CLI dist
+        run: |
+          mkdir -p dist
+          tar --zstd -xf /tmp/kilo-cli.tar.zst -C dist
+
+      - name: Run CLI smoke test
+        run: |
+          test "$(uname -m)" = "${{ matrix.uname }}"
+
+          smoke_host() {
+            binary="$1"
+            "$binary" --version
+            root="$(mktemp -d)"
+            trap 'rm -rf "$root"' RETURN
+            (
+              unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR
+              export XDG_DATA_HOME="$root/data"
+              export XDG_CACHE_HOME="$root/cache"
+              export XDG_CONFIG_HOME="$root/config"
+              export XDG_STATE_HOME="$root/state"
+              export KILO_DISABLE_MODELS_FETCH=1
+              export KILO_DISABLE_PROJECT_CONFIG=1
+              export KILO_CONFIG_CONTENT='{"enabled_providers":["anthropic"]}'
+              export ANTHROPIC_API_KEY=dummy
+              "$binary" --pure models anthropic | grep -q '^anthropic/'
+            )
+          }
+
+          if [ "${{ matrix.mode }}" = "host" ]; then
+            smoke_host "./dist/${{ matrix.package }}/bin/kilo"
+            exit 0
+          fi
+
+          docker run --rm \
+            --platform "${{ matrix.platform }}" \
+            -v "$PWD/dist:/dist:ro" \
+            -e PACKAGE="${{ matrix.package }}" \
+            alpine:3.22 \
+            sh -c '
+              set -eu
+              # kilocode_change start - Bun musl binaries link against libstdc++ and libgcc_s
+              # (GCC C++ runtime). Alpine does not ship these by default; they are available
+              # as optional packages and must be installed for any Bun-compiled musl binary to run.
+              apk add --no-cache libstdc++ libgcc
+              # kilocode_change end
+              binary="/dist/$PACKAGE/bin/kilo"
+              "$binary" --version
+              root="$(mktemp -d)"
+              trap '\''rm -rf "$root"'\'' EXIT
+              unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR
+              export XDG_DATA_HOME="$root/data"
+              export XDG_CACHE_HOME="$root/cache"
+              export XDG_CONFIG_HOME="$root/config"
+              export XDG_STATE_HOME="$root/state"
+              export KILO_DISABLE_MODELS_FETCH=1
+              export KILO_DISABLE_PROJECT_CONFIG=1
+              export KILO_CONFIG_CONTENT='\''{"enabled_providers":["anthropic"]}'\''
+              export ANTHROPIC_API_KEY=dummy
+              "$binary" --pure models anthropic | grep -q "^anthropic/"
+            '
+
+  validate-cli-windows:
+    name: Validate CLI (windows-${{ matrix.arch }})
+    needs: build-cli
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            runner: windows-11-arm
+            package: "@kilocode/cli-windows-arm64"
+          - arch: x64
+            runner: windows-2025
+            package: "@kilocode/cli-windows-x64"
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: kilo-cli.tar.zst
+          path: ${{ runner.temp }}
+          skip-decompress: true
+
+      - name: Install zstd
+        shell: pwsh
+        run: |
+          if (-not (Get-Command zstd -ErrorAction SilentlyContinue)) {
+            choco install zstandard -y --no-progress
+          }
+
+      - name: Unpack CLI dist
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path dist | Out-Null
+          zstd -d --stdout "$env:RUNNER_TEMP\kilo-cli.tar.zst" | tar -xf - -C dist
+
+      - name: Run CLI smoke test
+        shell: pwsh
+        run: |
+          $package = "${{ matrix.package }}".Replace("/", "\")
+          $binary = ".\dist\$package\bin\kilo.exe"
+          & $binary --version
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          $root = Join-Path $env:RUNNER_TEMP ([guid]::NewGuid().ToString())
+          New-Item -ItemType Directory -Force -Path $root | Out-Null
+          try {
+            foreach ($name in "KILO_MODELS_PATH", "KILO_MODELS_URL", "KILO_CONFIG", "KILO_CONFIG_DIR") {
+              Remove-Item "Env:$name" -ErrorAction SilentlyContinue
+            }
+            $env:XDG_DATA_HOME = Join-Path $root "data"
+            $env:XDG_CACHE_HOME = Join-Path $root "cache"
+            $env:XDG_CONFIG_HOME = Join-Path $root "config"
+            $env:XDG_STATE_HOME = Join-Path $root "state"
+            $env:KILO_DISABLE_MODELS_FETCH = "1"
+            $env:KILO_DISABLE_PROJECT_CONFIG = "1"
+            $env:KILO_CONFIG_CONTENT = '{"enabled_providers":["anthropic"]}'
+            $env:ANTHROPIC_API_KEY = "dummy"
+            $output = & $binary --pure models anthropic
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+            if (-not ($output -match "(?m)^anthropic/")) {
+              throw "Compiled Windows binary did not list Anthropic models from the embedded snapshot"
+            }
+          } finally {
+            Remove-Item -Recurse -Force $root -ErrorAction SilentlyContinue
+          }
+  # kilocode_change end
+  build-vscode:
+    needs:
+      - build-cli
+      - validate-cli-unix
+      - validate-cli-windows
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'Kilo-Org/kilocode'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6 # kilocode_change
 
       - uses: ./.github/actions/setup-bun
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6 # kilocode_change
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -135,10 +315,11 @@ jobs:
         run: bun install -g @vscode/vsce
 
       # kilocode_change start - download into /tmp and extract the tar.zst packed by build-cli
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
-          name: kilo-cli
+          name: kilo-cli.tar.zst
           path: /tmp
+          skip-decompress: true
 
       - name: Unpack CLI dist
         run: |
@@ -154,127 +335,11 @@ jobs:
           KILO_PRE_RELEASE: ${{ inputs.pre_release }}
           GH_REPO: ${{ github.repository }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7 # kilocode_change
         with:
           name: kilo-vscode
           path: packages/kilo-vscode/out
 
-  # build-tauri:
-  #   needs:
-  #     - build-cli
-  #     - version
-  #   continue-on-error: false
-  #   strategy:
-  #     fail-fast: false
-  #     matrix:
-  #       settings:
-  #         - host: macos-latest
-  #           target: x86_64-apple-darwin
-  #         - host: macos-latest
-  #           target: aarch64-apple-darwin
-  #         - host: blacksmith-4vcpu-windows-2025
-  #           target: x86_64-pc-windows-msvc
-  #         - host: blacksmith-4vcpu-ubuntu-2404
-  #           target: x86_64-unknown-linux-gnu
-  #         - host: blacksmith-8vcpu-ubuntu-2404-arm
-  #           target: aarch64-unknown-linux-gnu
-  #   runs-on: ${{ matrix.settings.host }}
-  #   steps:
-  #     - uses: actions/checkout@v3
-  #       with:
-  #         fetch-tags: true
-
-  #     - uses: apple-actions/import-codesign-certs@v2
-  #       if: ${{ runner.os == 'macOS' }}
-  #       with:
-  #         keychain: build
-  #         p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
-  #         p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-
-  #     - name: Verify Certificate
-  #       if: ${{ runner.os == 'macOS' }}
-  #       run: |
-  #         CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
-  #         CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-  #         echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
-  #         echo "Certificate imported."
-
-  #     - name: Setup Apple API Key
-  #       if: ${{ runner.os == 'macOS' }}
-  #       run: |
-  #         echo "${{ secrets.APPLE_API_KEY_PATH }}" > $RUNNER_TEMP/apple-api-key.p8
-
-  #     - uses: ./.github/actions/setup-bun
-
-  #     - name: Cache apt packages
-  #       if: contains(matrix.settings.host, 'ubuntu')
-  #       uses: actions/cache@v4
-  #       with:
-  #         path: /var/cache/apt/archives
-  #         key: ${{ runner.os }}-${{ matrix.settings.target }}-apt-${{ hashFiles('.github/workflows/publish.yml') }}
-  #         restore-keys: |
-  #           ${{ runner.os }}-${{ matrix.settings.target }}-apt-
-
-  #     - name: install dependencies (ubuntu only)
-  #       if: contains(matrix.settings.host, 'ubuntu')
-  #       run: |
-  #         sudo apt-get update
-  #         sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
-
-  #     - name: install Rust stable
-  #       uses: dtolnay/rust-toolchain@stable
-  #       with:
-  #         targets: ${{ matrix.settings.target }}
-
-  #     - uses: Swatinem/rust-cache@v2
-  #       with:
-  #         workspaces: packages/desktop/src-tauri
-  #         shared-key: ${{ matrix.settings.target }}
-
-  #     - name: Prepare
-  #       run: |
-  #         cd packages/desktop
-  #         bun ./scripts/prepare.ts
-  #       env:
-  #         KILO_VERSION: ${{ needs.version.outputs.version }}
-  #         GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
-  #         RUST_TARGET: ${{ matrix.settings.target }}
-  #         GH_TOKEN: ${{ github.token }}
-  #         GITHUB_RUN_ID: ${{ github.run_id }}
-
-  #     # Fixes AppImage build issues, can be removed when https://github.com/tauri-apps/tauri/pull/12491 is released
-  #     - name: Install tauri-cli from portable appimage branch
-  #       if: contains(matrix.settings.host, 'ubuntu')
-  #       run: |
-  #         cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch feat/truly-portable-appimage --force
-  #         echo "Installed tauri-cli version:"
-  #         cargo tauri --version
-
-  #     - name: Build and upload artifacts
-  #       uses: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
-  #       timeout-minutes: 60
-  #       with:
-  #         projectPath: packages/desktop
-  #         uploadWorkflowArtifacts: true
-  #         tauriScript: ${{ (contains(matrix.settings.host, 'ubuntu') && 'cargo tauri') || '' }}
-  #         args: --target ${{ matrix.settings.target }} --config ./src-tauri/tauri.prod.conf.json --verbose
-  #         updaterJsonPreferNsis: true
-  #         releaseId: ${{ needs.version.outputs.release }}
-  #         tagName: ${{ needs.version.outputs.tag }}
-  #         releaseDraft: true
-  #         releaseAssetNamePattern: opencode-desktop-[platform]-[arch][ext]
-  #       env:
-  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  #         TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: true
-  #         TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-  #         TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-  #         APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-  #         APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-  #         APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
-  #         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-  #         APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-  #         APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
-
   # kilocode_change start
   # Run smoke tests against CLI assets uploaded to the draft GitHub release
   # before publishing the release and package artifacts.
@@ -289,16 +354,22 @@ jobs:
       cli_version: ${{ needs.version.outputs.version }}
     secrets: inherit
   # kilocode_change end
+
   publish:
     needs:
       - version
       - build-cli
       - build-vscode
+      - validate-cli-unix # kilocode_change
+      - validate-cli-windows # kilocode_change
       - smoke-test
-      # - build-tauri
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6 # kilocode_change
+        # kilocode_change start
+        with:
+          persist-credentials: false
+        # kilocode_change end
 
       - uses: ./.github/actions/setup-bun
 
@@ -315,10 +386,11 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6 # kilocode_change
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false # kilocode_change
 
       - name: Install @vscode/vsce
         run: bun install -g @vscode/vsce
@@ -333,23 +405,24 @@ jobs:
           # kilocode_change end
 
       # kilocode_change start - download into /tmp and extract the tar.zst packed by build-cli
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
-          name: kilo-cli
+          name: kilo-cli.tar.zst
           path: /tmp
+          skip-decompress: true
 
       - name: Unpack CLI dist
         run: |
           mkdir -p packages/opencode/dist
           tar --zstd -xf /tmp/kilo-cli.tar.zst -C packages/opencode/dist
       # kilocode_change end
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: kilo-vscode
           path: packages/kilo-vscode/out
 
       - name: Cache apt packages (AUR)
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: /var/cache/apt/archives
           key: ${{ runner.os }}-apt-aur-${{ hashFiles('.github/workflows/publish.yml') }}
@@ -375,7 +448,6 @@ jobs:
           GH_REPO: ${{ github.repository }}
           AUR_KEY: ${{ secrets.AUR_KEY }}
           GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
           VSCE_PAT: ${{ secrets.VSCE_TOKEN }}
           OPENVSX_TOKEN: ${{ secrets.OVSX_TOKEN }}

.github/workflows/smoke-test.yml

@@ -47,7 +47,7 @@ jobs:
       KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
     steps:
       - name: Checkout kilo-bench
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           repository: Kilo-Org/kilo-bench
           token: ${{ secrets.BENCH_GITHUB_TOKEN }}
@@ -96,6 +96,16 @@ jobs:
           echo "cli_url=$URL" >> "$GITHUB_OUTPUT"
           echo "::notice::Testing CLI v${VERSION} via asset API: $URL"
 
+      # Harbor's default agent-setup timeout is 360s. The hello-world container
+      # (FROM ubuntu:24.04) needs apt-get update + apt-get install + a NodeSource
+      # curl|bash + apt install nodejs before the CLI even downloads, and on
+      # the Blacksmith runners that occasionally pushes past 6 min when an apt
+      # mirror or NodeSource cdn is slow, killing the run with
+      # AgentSetupTimeoutError. Doubling the multiplier to 2 gives enough
+      # headroom for transient mirror/cdn slowness while still finishing well
+      # under timeout-minutes. Note: --timeout-multiplier scales every timeout
+      # uniformly (setup, agent, verifier, env build), but they're all upper
+      # limits so this is harmless.
       - name: Run smoke test — hello-world
         env:
           KILO_CLI_URL: ${{ steps.cli.outputs.cli_url }}
@@ -104,7 +114,8 @@ jobs:
           ./scripts/run_eval.sh \
             -m kilo/anthropic/claude-sonnet-4.6 \
             -d hello-world \
-            --job-name smoke-test-hello-world
+            --job-name smoke-test-hello-world \
+            --timeout-multiplier 2
 
       - name: Run smoke test — log-summary-date-ranges
         env:
@@ -114,19 +125,27 @@ jobs:
           ./scripts/run_eval.sh \
             -m kilo/anthropic/claude-sonnet-4.6 \
             -d terminal-bench-sample \
-            -t "log-summary-date-ranges" \
-            --job-name smoke-test-log-summary
+            --include-task-name "log-summary-date-ranges" \
+            --job-name smoke-test-log-summary \
+            --timeout-multiplier 2
 
       - name: Validate results
         run: python3 scripts/validate_smoke_test.py jobs/smoke-test-*/
 
+      # Also upload the agent setup logs (stdout/stderr/return-code from the
+      # CLI install script) so we can see exactly which step stalls when the
+      # next AgentSetupTimeoutError happens. These come from the install
+      # script in kilo-bench, which uses `set -euo pipefail` (no `set -x`)
+      # and never echoes auth tokens or API keys, so the captured output is
+      # safe to upload.
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7 # kilocode_change
         with:
           name: smoke-test-results
           path: |
             jobs/smoke-test-*/**/result.json
             jobs/smoke-test-*/**/trajectory.json
+            jobs/smoke-test-*/**/agent/setup/*.txt
           retention-days: 30
           if-no-files-found: warn

.github/workflows/source-check-links.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6 # kilocode_change
 
       - uses: oven-sh/setup-bun@v2
 

.github/workflows/storybook.yml

@@ -1,39 +0,0 @@
-name: storybook
-
-on:
-  push:
-    branches: [dev]
-    paths:
-      - ".github/workflows/storybook.yml"
-      - "package.json"
-      - "bun.lock"
-      - "packages/storybook/**"
-      - "packages/ui/**"
-  pull_request:
-    branches: [dev]
-    paths:
-      - ".github/workflows/storybook.yml"
-      - "package.json"
-      - "bun.lock"
-      - "packages/storybook/**"
-      - "packages/ui/**"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    if: false
-    name: storybook build
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: ./.github/actions/setup-bun
-
-      - name: Build Storybook
-        run: bun --cwd packages/storybook build

.github/workflows/test-jetbrains.yml

@@ -0,0 +1,103 @@
+# kilocode_change - new file
+name: test-jetbrains
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  changes:
+    name: detect JetBrains changes
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    outputs:
+      jetbrains: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.filter.outputs.jetbrains }}
+    steps:
+      - name: Checkout repository
+        if: github.event_name != 'workflow_dispatch'
+        uses: actions/checkout@v6
+
+      - name: Detect JetBrains changes
+        if: github.event_name != 'workflow_dispatch'
+        id: filter
+        uses: Kilo-Org/paths-filter@668c092af3649c4b664c54e4b704aa46782f6f7c # v3
+        with:
+          predicate-quantifier: every
+          filters: |
+            jetbrains:
+              - '**'
+              - '!packages/kilo-vscode/**'
+              - '!packages/kilo-docs/**'
+
+  unit:
+    name: jetbrains
+    needs: changes
+    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.jetbrains == 'true'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    container:
+      image: ghcr.io/kilo-org/build/jetbrains:24.04
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mark workspace as git-safe
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run JetBrains unit tests
+        run: bun script/test-ci.ts
+        working-directory: packages/kilo-jetbrains
+
+      - name: Publish JetBrains unit reports
+        if: always()
+        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
+        with:
+          report_paths: packages/kilo-jetbrains/.artifacts/unit/junit.xml
+          check_name: "unit results (jetbrains)"
+          detailed_summary: true
+          include_time_in_summary: true
+          fail_on_failure: false
+
+      - name: Upload JetBrains unit artifacts
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: unit-jetbrains-${{ github.run_attempt }}
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 7
+          path: packages/kilo-jetbrains/.artifacts/unit/junit.xml
+
+  required:
+    name: result
+    needs:
+      - changes
+      - unit
+    if: always()
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Verify JetBrains jobs passed
+        run: |
+          echo "changes=${{ needs.changes.result }}"
+          echo "jetbrains=${{ needs.unit.result }}"
+          test "${{ needs.changes.result }}" = "success"
+          if [ "${{ needs.changes.outputs.jetbrains }}" = "true" ]; then
+            test "${{ needs.unit.result }}" = "success"
+          else
+            test "${{ needs.changes.outputs.jetbrains }}" = "false"
+            test "${{ needs.unit.result }}" = "skipped"
+          fi

.github/workflows/test-vscode.yml

@@ -27,7 +27,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/test.yml

@@ -21,6 +21,7 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
+  # kilocode_change start
   unit:
     name: unit (${{ matrix.settings.name }})
     strategy:
@@ -28,24 +29,35 @@ jobs:
       matrix:
         settings:
           - name: linux
-            host: blacksmith-8vcpu-ubuntu-2404
+            host: blacksmith-4vcpu-ubuntu-2404 # kilocode_change
           - name: windows
-            host: blacksmith-8vcpu-windows-2025
+            host: blacksmith-4vcpu-windows-2025 # kilocode_change
     runs-on: ${{ matrix.settings.host }}
+    timeout-minutes: 45 # kilocode_change
     defaults:
       run:
         shell: bash
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
+      # kilocode_change start
       - name: Setup Node
-        uses: actions/setup-node@v4
+        id: setup-node
+        continue-on-error: ${{ runner.os == 'Windows' }}
+        uses: actions/setup-node@v6 # kilocode_change
         with:
           node-version: "24"
 
+      - name: Retry Setup Node on Windows
+        if: runner.os == 'Windows' && steps.setup-node.outcome == 'failure'
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+      # kilocode_change end
+
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
 
@@ -55,7 +67,7 @@ jobs:
           git config --global user.name "kilo-maintainer[bot]"
 
       - name: Cache Turbo
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: node_modules/.cache/turbo
           key: turbo-${{ runner.os }}-${{ hashFiles('turbo.json', '**/package.json') }}-${{ github.sha }}
@@ -64,13 +76,18 @@ jobs:
             turbo-${{ runner.os }}-
 
       - name: Run unit tests
-        run: bun turbo test:ci
+        run: bun turbo test:ci --filter='!@kilocode/kilo-jetbrains'
         env:
           KILO_EXPERIMENTAL_DISABLE_FILEWATCHER: ${{ runner.os == 'Windows' && 'true' || 'false' }}
 
+      - name: Run HttpApi exerciser gates
+        if: runner.os == 'Linux'
+        working-directory: packages/opencode
+        run: bun run test:httpapi
+
       - name: Publish unit reports
         if: always()
-        uses: mikepenz/action-junit-report@v6
+        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
         with:
           report_paths: packages/*/.artifacts/unit/junit.xml
           check_name: "unit results (${{ matrix.settings.name }})"
@@ -80,103 +97,38 @@ jobs:
 
       - name: Upload unit artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7 # kilocode_change
         with:
           name: unit-${{ matrix.settings.name }}-${{ github.run_attempt }}
           include-hidden-files: true
           if-no-files-found: ignore
           retention-days: 7
           path: packages/*/.artifacts/unit/junit.xml
+  # kilocode_change end
 
-  e2e:
-    # kilocode_change - disabled: packages/app is not actively maintained
-    if: false
-    name: e2e (${{ matrix.settings.name }})
-    strategy:
-      fail-fast: false
-      matrix:
-        settings:
-          - name: linux
-            host: blacksmith-4vcpu-ubuntu-2404
-          - name: windows
-            host: blacksmith-4vcpu-windows-2025
-    runs-on: ${{ matrix.settings.host }}
-    env:
-      PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-
-      - name: Setup Bun
-        uses: ./.github/actions/setup-bun
-
-      - name: Read Playwright version
-        id: playwright-version
-        run: |
-          version=$(node -e 'console.log(require("./package.json").workspaces.catalog["@playwright/test"])')
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Cache Playwright browsers
-        id: playwright-cache
-        uses: actions/cache@v4
-        with:
-          path: ${{ github.workspace }}/.playwright-browsers
-          key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright-version.outputs.version }}-chromium
-
-      - name: Install Playwright system dependencies
-        if: runner.os == 'Linux'
-        working-directory: packages/app
-        run: bunx playwright install-deps chromium
-
-      - name: Install Playwright browsers
-        if: steps.playwright-cache.outputs.cache-hit != 'true'
-        working-directory: packages/app
-        run: bunx playwright install chromium
-
-      - name: Run app e2e tests
-        run: bun --cwd packages/app test:e2e:local
-        env:
-          CI: true
-          # kilocode_change start
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          KILO_DISABLE_SHARE: "true"
-          KILO_DISABLE_SESSION_INGEST: "true"
-          KILO_E2E_REQUIRE_PAID: "true"
-          # kilocode_change end
-          PLAYWRIGHT_JUNIT_OUTPUT: e2e/junit-${{ matrix.settings.name }}.xml
-        timeout-minutes: 30
-
-      - name: Upload Playwright artifacts
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: playwright-${{ matrix.settings.name }}-${{ github.run_attempt }}
-          if-no-files-found: ignore
-          retention-days: 7
-          path: |
-            packages/app/e2e/junit-*.xml
-            packages/app/e2e/test-results
-            packages/app/e2e/playwright-report
+  # kilocode_change start
+  jetbrains:
+    name: jetbrains
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: read
+    uses: ./.github/workflows/test-jetbrains.yml
+  # kilocode_change end
 
+  # kilocode_change start
   required:
     name: test (linux)
     runs-on: blacksmith-4vcpu-ubuntu-2404
     needs:
       - unit
+      - jetbrains
     if: always()
     steps:
       - name: Verify upstream test jobs passed
         run: |
           echo "unit=${{ needs.unit.result }}"
+          echo "jetbrains=${{ needs.jetbrains.result }}"
           test "${{ needs.unit.result }}" = "success"
+          test "${{ needs.jetbrains.result }}" = "success"
+  # kilocode_change end

.github/workflows/triage.yml

@@ -1,39 +0,0 @@
-name: triage
-
-on:
-  issues:
-    types: [opened]
-
-jobs:
-  triage:
-    if: github.repository == 'Kilo-Org/kilocode'
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Setup Bun
-        uses: ./.github/actions/setup-bun
-
-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
-
-      - name: Triage issue
-        env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-          ISSUE_BODY: ${{ github.event.issue.body }}
-        run: |
-          kilo run --agent triage "The following issue was just opened, triage it:
-
-          Title: $ISSUE_TITLE
-
-          $ISSUE_BODY"

.github/workflows/typecheck.yml

@@ -8,14 +8,62 @@ on:
   workflow_dispatch:
 
 jobs:
-  typecheck:
+  typecheck-js:
+    name: typecheck-js
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
 
-      - name: Run typecheck
-        run: bun typecheck
+      # kilocode_change start
+      - name: Run TypeScript typecheck
+        run: bun turbo typecheck --filter='!@kilocode/kilo-jetbrains'
+
+      - name: Build Kilo Console
+        run: bun turbo build --filter=@kilocode/kilo-console
+      # kilocode_change end
+
+  # kilocode_change start
+  typecheck-jetbrains:
+    name: typecheck-jetbrains
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+
+      - name: Run JetBrains typecheck
+        run: ./gradlew typecheck
+        working-directory: packages/kilo-jetbrains
+
+  required:
+    name: typecheck
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs:
+      - typecheck-js
+      - typecheck-jetbrains
+    if: always()
+    steps:
+      - name: Verify typecheck jobs passed
+        run: |
+          echo "typecheck-js=${{ needs.typecheck-js.result }}"
+          echo "typecheck-jetbrains=${{ needs.typecheck-jetbrains.result }}"
+          test "${{ needs.typecheck-js.result }}" = "success"
+          test "${{ needs.typecheck-jetbrains.result }}" = "success"
+  # kilocode_change end

.github/workflows/visual-regression.yml

@@ -12,22 +12,26 @@ jobs:
       matched: ${{ steps.filter.outputs.matched }}
       is_fork: ${{ steps.fork-check.outputs.is_fork }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: Kilo-Org/paths-filter@master
+      - uses: actions/checkout@v6 # kilocode_change
+      # kilocode_change start
+      - name: Check changed files
         id: filter
-        with:
-          filters: |
-            matched:
-              - "packages/kilo-ui/**"
-              - "packages/ui/**"
-              - "packages/util/**"
-              - "packages/sdk/js/**"
-              - "packages/kilo-vscode/webview-ui/**"
-              - "packages/kilo-vscode/.storybook/**"
-              - "packages/kilo-vscode/tests/visual-regression*"
-              - "packages/kilo-vscode/tests/permission-dock-dropdown*"
-              - "packages/kilo-docs/public/img/screenshot-tests/**"
-              - ".github/workflows/visual-regression.yml"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          matched=false
+          while IFS= read -r file; do
+            case "$file" in
+              packages/kilo-ui/*|packages/ui/*|packages/util/*|packages/sdk/js/*|packages/kilo-vscode/webview-ui/*|packages/kilo-vscode/.storybook/*|packages/kilo-vscode/tests/visual-regression*|packages/kilo-vscode/tests/permission-dock-dropdown*|packages/kilo-vscode/tests/accessibility*|packages/kilo-docs/public/img/screenshot-tests/*|.github/workflows/visual-regression.yml)
+                matched=true
+                break
+                ;;
+            esac
+          done < <(gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls/${PR}/files" --jq '.[].filename')
+          echo "matched=$matched" >> "$GITHUB_OUTPUT"
+          echo "matched=$matched"
+      # kilocode_change end
       - name: Check if PR is from a fork
         id: fork-check
         run: |
@@ -47,7 +51,7 @@ jobs:
     steps:
       - name: Checkout (internal)
         if: needs.check-paths.outputs.is_fork != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           lfs: true
           token: ${{ secrets.BOT_PAT }}
@@ -55,7 +59,7 @@ jobs:
 
       - name: Checkout (fork)
         if: needs.check-paths.outputs.is_fork == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           lfs: true
 
@@ -77,7 +81,7 @@ jobs:
           bun-version: latest
 
       - name: Cache Bun modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: ~/.bun/install/cache
           key: bun-${{ hashFiles('bun.lock') }}
@@ -87,7 +91,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ hashFiles('packages/kilo-ui/package.json') }}
@@ -103,7 +107,7 @@ jobs:
 
       - name: Cache Storybook build
         id: storybook-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: packages/kilo-ui/storybook-static
           key: storybook-${{ hashFiles('packages/kilo-ui/src/**', 'packages/kilo-ui/.storybook/**', 'packages/ui/src/**', 'packages/kilo-ui/package.json') }}
@@ -195,7 +199,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7 # kilocode_change
         with:
           name: visual-regression-results
           path: packages/kilo-ui/test-results/
@@ -207,11 +211,15 @@ jobs:
     name: Visual Regression (kilo-vscode webview)
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
+    # kilocode_change start
+    env:
+      NODE_OPTIONS: --max-old-space-size=4096
+    # kilocode_change end
 
     steps:
       - name: Checkout (internal)
         if: needs.check-paths.outputs.is_fork != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           lfs: true
           token: ${{ secrets.BOT_PAT }}
@@ -219,7 +227,7 @@ jobs:
 
       - name: Checkout (fork)
         if: needs.check-paths.outputs.is_fork == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6 # kilocode_change
         with:
           lfs: true
 
@@ -241,7 +249,7 @@ jobs:
           bun-version: latest
 
       - name: Cache Bun modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: ~/.bun/install/cache
           key: bun-${{ hashFiles('bun.lock') }}
@@ -251,7 +259,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: playwright-cache-vscode
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: ~/.cache/ms-playwright
           key: playwright-vscode-${{ hashFiles('packages/kilo-vscode/package.json') }}
@@ -267,7 +275,7 @@ jobs:
 
       - name: Cache Storybook build
         id: storybook-cache-vscode
-        uses: actions/cache@v4
+        uses: actions/cache@v5 # kilocode_change
         with:
           path: packages/kilo-vscode/storybook-static
           key: storybook-vscode-${{ hashFiles('packages/kilo-vscode/webview-ui/src/**', 'packages/kilo-vscode/.storybook/**', 'packages/kilo-ui/src/**', 'packages/ui/src/**', 'packages/kilo-vscode/package.json') }}
@@ -276,13 +284,18 @@ jobs:
         if: steps.storybook-cache-vscode.outputs.cache-hit != 'true'
         run: bun run build-storybook
         working-directory: packages/kilo-vscode
+        # kilocode_change start
+        env:
+          NODE_OPTIONS: --max-old-space-size=4096
+        # kilocode_change end
 
-      - name: Generate baselines for new/missing stories
+      - name: Generate baselines and enforce webview accessibility checks # kilocode_change
         run: bun run test:visual:update
         working-directory: packages/kilo-vscode
         env:
           CI: true
           PLAYWRIGHT_WORKERS: "4"
+          NODE_OPTIONS: --max-old-space-size=4096 # kilocode_change
 
       - name: Remove stale baselines for deleted stories
         run: |
@@ -386,7 +399,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7 # kilocode_change
         with:
           name: visual-regression-vscode-results
           path: packages/kilo-vscode/test-results/

.github/workflows/watch-opencode-releases.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check-release:
-    if: vars.OPENCODE_WATCH_ENABLED != 'false'
+    if: github.repository == 'Kilo-Org/kilocode' && vars.OPENCODE_WATCH_ENABLED != 'false'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -40,9 +40,12 @@ jobs:
         env:
           URL: ${{ secrets.OPENCODE_WATCH_SYNC_URL }}
           SECRET: ${{ secrets.OPENCODE_WATCH_SYNC_SECRET }}
+          VERCEL: ${{ secrets.OPENCODE_WATCH_VERCEL_SECRET }}
         run: |
           if [ -n "$URL" ] && [ -n "$SECRET" ]; then
-            curl -sf -X POST "$URL" -H "x-sync-secret: $SECRET" -H "Content-Type: application/json" -d '{}' || true
+            headers=(-H "x-sync-secret: $SECRET" -H "Content-Type: application/json")
+            [ -n "$VERCEL" ] && headers+=(-H "x-vercel-protection-bypass: $VERCEL")
+            curl -sf -X POST "$URL" "${headers[@]}" -d '{}' || true
           fi
 
       - if: steps.fetch.outputs.tag != '' && steps.cache.outputs.cache-hit != 'true'

.gitignore

@@ -1,9 +1,11 @@
 .husky/_
 .DS_Store
+.secrets/
 node_modules
 .worktrees
 .sst
 .env
+.env.local
 .idea/*
 !.idea/gradle.xml
 !.idea/.run
@@ -33,9 +35,11 @@ a.out
 target
 .scripts
 .direnv/
+packages/kilo-jetbrains/build-tasks/.gradle/
 
 # Local dev files
 opencode-dev
+.kilo-dev/
 UPCOMING_CHANGELOG.md
 logs/
 *.bun-build
@@ -45,8 +49,22 @@ telemetry-id
 tsconfig.tsbuildinfo
 
 # Kilo
+.kilo/.gitignore
+.kilo/package.json
+.kilo/package-lock.json
+.kilo/pnpm-lock.yaml
+.kilo/bun.lock
+.kilo/yarn.lock
+.kilo/node_modules
 .kilo/plans/*upstream-merge-report-*.md
+.kilocode/.gitignore
+.kilocode/package.json
+.kilocode/package-lock.json
+.kilocode/pnpm-lock.yaml
+.kilocode/bun.lock
+.kilocode/yarn.lock
+.kilocode/node_modules
 
 # Test Artifacts
 packages/app/.artifacts/
-packages/opencode/.artifacts/
+packages/opencode/.artifacts/

.gitleaksignore

@@ -0,0 +1,5 @@
+# Fake secret-looking strings used by HTTP recorder redaction tests.
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:generic-api-key:69
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:generic-api-key:92
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:generic-api-key:146
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:gcp-api-key:71

.kilo/agent/upstream-merge.md

@@ -0,0 +1,421 @@
+---
+description: Resolve upstream opencode merge conflicts interactively
+mode: primary
+permission:
+  read: ask
+  edit: ask
+  webfetch: ask
+  bash:
+    "*": ask
+    "git status *": allow
+    "git log *": allow
+    "git diff *": allow
+    "git show *": allow
+    "git ls-files *": allow
+    "git ls-tree *": allow
+    "git grep *": allow
+    "git hash-object *": allow
+    "git remote -v *": allow
+    "git rev-parse *": allow
+    "git merge-base *": allow
+    "git show-ref *": allow
+    "git worktree list": allow
+    "git branch --show-current": allow
+    "grep *": allow
+    "rg *": allow
+    "head *": allow
+    "tail *": allow
+    "cat *": allow
+    "wc *": allow
+    "ls *": allow
+    "pwd *": allow
+    "diff *": allow
+    "gh pr view *": allow
+    "gh run view *": allow
+    "gh api \"repos/sst/opencode/commits/dev\" *": allow
+    "axiom *": allow
+    "bun test *": allow
+    "bun run typecheck *": allow
+    "bun run lint *": allow
+    "bun run script/check-opencode-annotations.ts *": allow
+    "script/upstream/find-conflict-markers.sh *": allow
+    "./script/upstream/find-conflict-markers.sh *": allow
+---
+
+Resolve the manual part of an upstream merge.
+
+**Do not load the `kilocode-merge-minimizer` skill.** That skill is for
+authoring new Kilo changes against shared upstream files; during an upstream
+merge it gives the wrong guidance (it nudges toward extracting Kilo logic out
+of conflict regions, which is exactly the opposite of what merge resolution
+needs). Follow the rules in this agent file instead.
+
+The user will provide the upstream version (for example `v1.1.50` or `1.1.50`)
+in their first message. If they don't, infer it from the current branch name,
+from `upstream-merge-report-<version>.md`, or from the newest relevant report
+file.
+
+## Workflow
+
+### 1. Inspect the current merge state
+
+- `git status --short`
+- `git diff --name-only --diff-filter=U`
+- `upstream-merge-report-<version>.md` when present
+- `.worktrees/opencode-merge/auto-merge` for the automated merge snapshot when present
+
+### 2. Read every conflicted file end-to-end before planning
+
+Use `script/upstream/find-conflict-markers.sh <file>` to jump to each region,
+then read enough surrounding lines to understand the code — not just the
+conflict hunk. Specifically check:
+
+- is this a plain 3-way on a single expression, or a structural refactor?
+- does upstream rename/move something that invalidates a HEAD-only declaration?
+- does a `kilocode_change` marker in HEAD encode a bug fix, a feature, or a
+  defensive check?
+- is the conflicted block referenced by *non-conflicted* code elsewhere in the
+  same file (imports, signatures, call sites) that will break if we drop it?
+
+When HEAD includes a non-obvious Kilo-specific wrapper (e.g. a helper in
+`packages/opencode/src/kilocode/`), find out why it exists before deciding to
+keep or bypass it:
+
+```bash
+git log --all --oneline -S "<symbol>" -- packages/opencode/src/kilocode/
+git log --all --oneline -- <kilo-file>
+```
+
+Look at the commit message and any PR reference. "We wrote our own because of
+PR #NNNN" is a real constraint; "we wrote our own because of a typo" is not.
+
+When upstream narrows an externally-visible compatibility list (models,
+providers, routes, config keys, file formats), verify the intent from upstream
+PRs, issues, release notes, or current docs before dropping entries. Treat
+silent list shrinkage during a refactor as suspicious until proven intentional.
+
+### 3. Write a plan in chat and get approval
+
+For every conflicted file (and any adjacent file the resolution forces you to
+touch — see §6) include:
+
+- expected resolution kind: `hybrid`, `take-ours`, `take-theirs`, `regenerated`,
+  `removed`, `renamed`, or `other`
+- risk level: `low`, `medium`, or `high`
+- one-sentence rationale (what Kilo behaviour is preserved, what upstream
+  feature is adopted, what is dropped)
+- verification commands you expect to run (targeted tests, typecheck)
+
+Group files by risk level. Ask the user which batch to start with. You can
+resolve an entire `low` batch in one pass if the user approves the batch, but
+resolve `medium` and `high` files one at a time.
+
+**Do not resolve a file until the user has approved that file's (or batch's)
+strategy.**
+
+### 4. Before every edit, explain reasoning before showing the diff
+
+The user needs to review intent, not just the raw change. For each file, in
+order:
+
+1. Show the conflict's surrounding context (10–30 lines around each conflict
+   region, in chat).
+2. Explain what each of the three sides (HEAD, merge-base, upstream) is doing.
+3. State which Kilo behaviour must survive and why (reference PR numbers /
+   `kilocode_change` comments when possible).
+4. State the resolution and why it is better than the alternatives.
+5. Then apply the edit. The tool will display the diff — the user only has to
+   verify the diff matches the reasoning.
+
+Do not lead with the diff. A diff without reasoning forces the user to
+reverse-engineer the decision.
+
+### 5. Apply resolution rules
+
+Reference worktrees when present:
+
+- `.worktrees/opencode-merge/opencode` — pristine upstream tree
+- `.worktrees/opencode-merge/kilo-main` — Kilo base snapshot
+- `.worktrees/opencode-merge/auto-merge` — automated merge snapshot (original
+  conflict reference)
+
+Apply in order:
+
+- prefer upstream code and architecture whenever compatible with Kilo behaviour
+- preserve Kilo-specific behaviour marked with `kilocode_change`
+- keep `kilocode_change` markers around Kilo-specific code in shared opencode
+  files
+- when upstream refactors a region that HEAD had annotated with
+  `kilocode_change`, **check whether the marker encodes a bug fix or a feature
+  delta**. Bug fixes (missing `await`, defensive null-check, error capture)
+  usually need to be re-applied on top of the upstream refactor. Example from
+  v1.14.30: `Workspace.isSyncing` was missing an `await` — upstream's Effect
+  refactor reintroduced the same bug, so we had to port the fix into the new
+  `Effect.gen` block.
+- when a `take-theirs` drops a line that was the target of a Kilo pre-filter,
+  the upstream line may be actively wrong for Kilo — e.g. an inner `continue`
+  filter whose condition collides with an outer filter Kilo added. Re-read the
+  surrounding 20 lines before committing to `take-theirs`.
+- if Kilo-specific code must be refactored to fit new upstream architecture,
+  explain the refactor in the final summary
+- if upstream moved the relevant logic to another file, port the Kilo behaviour
+  there and list both paths in the final summary. Verify the new file already
+  carries the Kilo-renamed symbols (e.g. `x-kilo-directory`) by diffing against
+  pristine upstream.
+- if upstream extracts shared policy into a helper, move Kilo-specific additions
+  into the helper when possible instead of keeping a pre-check at the old call
+  site. The extracted helper should stay the source of truth for all callers.
+- if upstream deleted a file, analyse whether the Kilo behaviour should be
+  ported elsewhere or removed rather than restoring the deleted file
+- if tests fail only because upstream intentionally removed behaviour, remove
+  or update the obsolete tests rather than adding the old file back
+- do not modify unrelated files
+
+When removing code that existed in one side of a conflict, prefer
+**commenting it out with `kilocode_change` markers** over deletion when the
+surrounding structure (an `if`, a loop) still makes sense. That keeps the
+intent visible to the next merger. Example:
+
+```ts
+} else if (input?.scope !== "project" && !Flag.KILO_EXPERIMENTAL_WORKSPACES) {
+  // kilocode_change start - directory filtering handled by KiloSession.filters above
+  // if (input?.directory) {
+  //   conditions.push(eq(SessionTable.directory, input.directory))
+  // }
+  // kilocode_change end
+}
+```
+
+Use `TODO:` not `NOTE:` for follow-ups. `TODO` is searchable and implies an
+owner will act on it; `NOTE` reads as permanent commentary.
+
+### 6. Look for adjacent files the conflict forces you to touch
+
+Upstream restructures sometimes split one file into several (e.g. `permission.ts`
+→ `groups/permission.ts` + `handlers/permission.ts`). Only the *renamed* file
+shows up in `git diff --diff-filter=U`; the new sibling may need a Kilo feature
+ported in too. After resolving the flagged file, check:
+
+- files that import from the resolved file — do they compile?
+- files at paths implied by new imports (e.g. `../middleware/*`, `./handlers/*`)
+- `kilocode_change` comments in the *auto-merge* snapshot that didn't end up in
+  the working tree because the hosting file was renamed
+
+Add any such files to the plan as `hybrid` or `take-ours` with the same
+approval flow.
+
+### 6.5. Scan auto-merged files for latent bugs
+
+Files not in `--diff-filter=U` merged without conflict markers but may still
+be broken. Check every auto-merged file for:
+
+- **Duplicate declarations in the same scope.** If both sides added equivalent
+  code independently, auto-merge keeps both. Grep touched functions for
+  repeated identifiers before trusting the merge.
+- **Duplicate keys in config/manifest files.** If both sides added the same
+  entry to a shared manifest (dependencies, scripts, workflow lists), the
+  merged file may have the key twice. This often breaks install/setup before
+  any test runs — a cheap early win to scan for.
+- **Orphaned imports and references.** A rename upstream may leave a Kilo
+  callsite pointing at a now-missing export. Run full typecheck from the repo
+  root; references that silently survived the merge surface there.
+- **Partial auto-merges.** Upstream may have refactored a region Kilo
+  deliberately stubbed out (commented blocks, removed fallbacks). If the
+  auto-merge pulled in references to names that only exist in the removed
+  path, the file compiles upstream but breaks on Kilo.
+
+### 7. Verify each resolution before moving on
+
+- confirm `script/upstream/find-conflict-markers.sh <file>` prints nothing
+- read the final file region (the new shape after edit) and sanity-check imports
+- for apparently-unused symbols upstream introduced, `grep` the file and the
+  rest of the package before deleting — they may be called from non-conflicted
+  code elsewhere. Example: `isTheme` in `theme.tsx` looked unused at the
+  resolution site but was called twice further down.
+- run the smallest relevant check (single `bun test` file, or `bun run
+  typecheck` in the touched package)
+- summarise the exact resolution, tradeoff, and verification result in chat
+- ask the user to approve the resolved file before staging it or resolving the
+  next one (for `medium` / `high`; `low` batches can be staged together)
+
+### 8. Run the full checks once everything is resolved
+
+- `git diff --name-only --diff-filter=U` returns empty
+- `bun run typecheck` from `packages/opencode/` (targeted) and from repo root
+  (catches non-conflicted call-site breakage)
+- relevant targeted tests. Tests that hang or time out in an unrelated part of
+  the graph may be pre-existing — note them, don't block the merge on them
+- `bun run script/check-opencode-annotations.ts` if `packages/opencode/` shared
+  files changed. Note that this tool compares against the merge base via `HEAD`
+  and will be silent until the merge commit lands
+- other CI guards that touched files imply (knip for `kilo-vscode/`,
+  `check-kilocode-change`, source-links, visual regression,
+  `script/check-forbidden-strings.ts`)
+- if you encounter a hardcoded upstream URL, repo path, or attribution string
+  during conflict resolution that obviously shouldn't ship in Kilo (e.g. another
+  `https://opencode.ai/...` link, an `anomalyco/opencode` reference, an
+  attribution header naming "opencode"), suggest adding a literal pattern for
+  it to `script/check-forbidden-strings.ts` in the merge summary so future
+  merges catch it automatically. Don't add it silently mid-merge — flag it for
+  the user.
+
+### 9. Commit with the standard message
+
+Per `script/upstream/README.md`:
+
+```bash
+git commit -m "resolve merge conflicts"
+```
+
+The default `git merge` auto-message (`Merge branch '…' into …`) is also fine,
+but `resolve merge conflicts` is the convention for these PRs.
+
+### 9.5. Handle downstream API renames as separate commits
+
+Upstream often renames exported APIs. The rename itself auto-merges cleanly in
+shared code, but the change cascades into Kilo-only files (kilocode tests,
+kilo-specific source, plugins) that still reference the old symbol. Those
+files don't appear in `--diff-filter=U` because their own content didn't
+conflict.
+
+Keep the behavioural merge commit focused on resolution decisions. Land the
+cascade in one or more follow-up commits:
+
+- after the merge commit, run full repo typecheck and collect every "cannot
+  find name" / "property does not exist" error
+- bulk-rename with a mechanical transform when the rename is one-to-one
+- restructure or parameter-thread when upstream changed semantics, not just
+  the name (e.g. moved a helper behind a dependency-injected surface, so
+  callers now need the injected handle)
+- split large downstream refactors into their own commits with messages that
+  name the rename
+
+Reviewers can then skim the behavioural commit without untangling mechanical
+rename noise from merge decisions.
+
+### 9.6. Handle upstream-added tests that diverge from Kilo
+
+Upstream sometimes adds tests that encode design contracts Kilo intentionally
+breaks. These auto-merge cleanly and then fail. Three resolution patterns:
+
+- **Rewrite the test** when the test is a contract assertion and Kilo has a
+  different but equally valid contract. Invert or adjust the assertion with a
+  `kilocode_change` marker explaining the divergence.
+- **Skip the test** when the test relies on patterns that Kilo has replaced
+  (interception seams that are bypassed by dependency injection, fixture
+  helpers bound to a removed API, assumptions about serialization shape that
+  Kilo's extensions break). Mark with `kilocode_change` and a rationale
+  explaining what would need to change for the test to run.
+- **Delete the test** when it covers functionality Kilo deliberately removed
+  (fallback paths, deprecated endpoints, products Kilo doesn't ship). Note
+  the deletion in the PR body.
+
+Never silently delete; always leave a breadcrumb. A future reviewer should be
+able to understand why this one upstream test is treated differently.
+
+### 10. Resync version strings in a separate commit
+
+Upstream stamps its own version into shared files — notably
+`packages/extensions/zed/extension.toml` (version field + 5 Kilo-Org download
+URLs), and any `package.json` that upstream bumped in the same release window.
+After the merge this leaves parts of the tree pointing at upstream's version
+(e.g. `1.14.30`), whose release tag does not exist on Kilo's pipeline, so the
+Zed download URLs silently 404.
+
+Fix this in a dedicated commit *after* `resolve merge conflicts`:
+
+```bash
+bun run script/sync-versions.ts             # uses root package.json version
+# or, to target an explicit version:
+bun run script/sync-versions.ts 7.2.41
+git add -A
+git commit -m "chore: resync versions after upstream merge"
+```
+
+The script rewrites every top-level `"version"` in `package.json` files
+(excluding `node_modules`, hidden dirs, and `packages/kilo-jetbrains/` which
+tracks its own cadence), plus the Zed extension toml. It is idempotent — rerun
+it any time to rebase the version back onto Kilo main (useful during
+long-running upstream merges where `main` releases in the meantime).
+
+Keeping this in its own commit makes reviewers' job easier: the merge commit
+only contains behavioural resolutions, and the version resync is a trivial
+diff they can skim in one glance.
+
+### 11. Write the PR body
+
+Structure the description so reviewers can skim:
+
+- **Non-trivial merge decisions**: a short section per file (or group of
+  related files) that required more than a mechanical `take-ours`/`take-theirs`.
+  Focus on *what Kilo behaviour survived* and *what upstream features were
+  adopted*. Link to Kilo PRs when a `kilocode_change` encodes a specific fix.
+- **Notable auto-merged changes**: new columns, new helper files, renamed
+  middleware — anything reviewers should eyeball even though git didn't flag
+  it.
+- **What to test**: explicit, scenario-level test steps for each non-trivial
+  change. Don't list tests; list *user-visible behaviour* so a tester who
+  doesn't read the diff can exercise it.
+- **CI guards to watch**: typecheck, knip, annotation check, visual regression.
+- **Follow-ups**: any `TODO:` you left in code, as a bullet list with links.
+
+## User-approval checkpoints
+
+Every manual merge decision requires explicit user approval **before applying**
+and **again after verification**. Be especially cautious when a decision is
+destructive, changes auth, billing, data deletion, public API compatibility,
+config schema behaviour, migrations, provider routing, or security posture.
+
+## Common pitfalls
+
+- Auto-merged code can reference declarations that still live inside conflict
+  blocks.
+- Related sibling files can need edits even when they are not listed as
+  unmerged — especially after upstream structural splits.
+- `renamed` should be used only when behaviour moves to a different file.
+- Function signatures can drift across conflict boundaries (args added, return
+  types widened). Grep for every call site before finalising.
+- Full-repo typecheck is the catch-all for non-conflicted call-site breakage.
+- Upstream can reintroduce bugs a Kilo `kilocode_change` had already fixed —
+  during big refactors check every `kilocode_change` the refactor touched.
+- "Take-theirs" on an inner conditional is often wrong when Kilo added an outer
+  pre-filter whose whole point was to widen what makes it to the inner block.
+- Apparently-unused upstream-added declarations may be called from
+  non-conflicted code elsewhere. Grep before deleting.
+- Stricter DOM lib types (upstream TS upgrade) can surface latent casting
+  issues around `WebSocket.send`, `Headers`, etc. — prefer narrowing the Kilo
+  type over adding `any` casts.
+- Auto-merge can duplicate the same declaration twice in one scope when both
+  sides added equivalent code independently. Silent for git, caught by
+  typecheck. Same hazard for duplicated object keys in config/manifest files —
+  those can break install before any test runs.
+- Kilo code may rely on ambient context (async-local storage, globally-set
+  flags, process env) being populated at a lifecycle moment that upstream
+  refactors away. If Kilo behaviour reads ambient state during init, forked
+  work, or event handlers, check the refactor still establishes that state at
+  the right time. Fix by restoring the ambient state, or by threading the
+  needed value through explicitly.
+- Tests that intercept via process-global or module-global spies can become
+  no-ops after upstream moves the intercepted code path through dependency
+  injection. The production code no longer touches the spied symbol. Fixing
+  the test usually means injecting a mock at the new seam rather than tweaking
+  the spy.
+- When Kilo extends a shared data shape with extra optional fields, different
+  serialization paths for that shape can diverge on whether missing values are
+  omitted or emitted as null. Parity tests between two such paths break on
+  every Kilo addition — audit the encoding assumption before adding fields.
+- Rule ordering in allowlist/permission evaluation is usually last-match-wins.
+  Re-declaring a catch-all rule "for safety" in a later ruleset silently
+  overrides more specific allow rules from an earlier ruleset. Treat a
+  redundant catch-all as destructive, not defensive.
+- Upstream-added tests can encode a design contract Kilo deliberately breaks.
+  The test passes upstream because upstream doesn't share Kilo's requirement.
+  Decide between refactoring Kilo to match the upstream contract or rewriting
+  the test to assert Kilo's divergent contract — with a `kilocode_change`
+  marker explaining the divergence.
+- CI and local can show different test failures. Tests that read user-local
+  state (home dir, global config, auth tokens) pass in one environment but
+  fail in the other. A green local run does not imply green CI.
+- Dependency manifests and lockfiles move together. When the merge edits one,
+  regenerate and commit the other in the same change — otherwise CI breaks on
+  the follow-up setup step.

.kilo/command/review-upstream-merge.md

@@ -0,0 +1,69 @@
+---
+description: Review an upstream merge PR and write reports
+---
+
+Review $1.
+
+Branch off so we have all the code for the reviewed PR. Then run the following reviews in parallel, using one subagent per review, and save each result in the named markdown file at the repository root. A human will read those files, so if in doubt add a finding for human verification.
+
+When all subagents are done, commit the report files and create a draft PR with the reviewed PR branch as base.
+
+Do not include exhaustive per-file checklists in the report files. Summarize the scope and methodology, then list only findings, notable non-findings, command outputs, and limitations.
+
+## KILOCODE_CHANGE_MARKERS.md
+
+Review carefully, file by file, whether we accidentally removed any `kilocode_change` marker.
+
+Get the full list of files changed in the reviewed PR. Check each changed file. For each file, compare both our `main` branch and the upstream-merged version in the reviewed PR. Determine whether any marker removal, marker move, or Kilo-specific change makes sense, and comment on that.
+
+Do not include a full "Files Checked" section. Mention the number of changed files checked, but only list files that have findings or need human verification.
+
+## INFRASTRUCTURE_CHANGE.md
+
+Review whether this PR adds, removes, or changes any infrastructure, such as GitHub Actions, CI config, release/deploy scripts, Docker/build infrastructure, package manager/workspace infrastructure, repository automation, issue templates, changelog automation, or generated SDK/build automation.
+
+We want to merge upstream code but keep our own infrastructure, so flag anything infrastructure-related. When in doubt, add a finding and say a human should check manually.
+
+Do not include a full "Files Checked" section. Only list infrastructure-relevant files and findings.
+
+## OPENCODE_MENTIONS.md
+
+Check whether the merge now mentions OpenCode somewhere user-facing instead of Kilo, or links to OpenCode web properties.
+
+Focus on UI strings, docs, help text, package metadata shown to users, URLs, CLI output, config docs, generated SDK/OpenAPI descriptions, and error messages.
+
+## UNNECESSARY_MARKERS.md
+
+Check whether any merged files now use `kilocode_change` markers without any actual difference to upstream.
+
+Use `script/upstream/find-reset-candidates.ts --dry-run` to see whether any files changed in the PR are actually now identical to upstream. If you find candidates, verify them with `script/upstream/reset-to-upstream.ts --dry-run`.
+
+## BROKEN_PIPELINE_CHAINS.md
+
+Review this PR for broken end-to-end chains where our custom functionality requires changes across multiple files or layers, but the merge may have removed or altered an intermediate step. The code may still compile, so these issues can be silent.
+
+Look for cases like:
+
+- A parameter that is set but never read.
+- A field that is populated but never passed through.
+- An event that is emitted but no longer handled.
+- A config option that is defined but never propagated to where it is used.
+- A type definition extended on one side but not consumed on the other.
+
+For each `kilocode_change` in this PR, trace the full chain: where the value or behavior is introduced, where it needs to flow through, and where it is ultimately consumed. Verify every link in the chain still exists after the merge.
+
+Pay special attention to:
+
+- Props or parameters passed through multiple component or function layers.
+- Values written to state, context, or storage that are read elsewhere.
+- Message types, events, or IPC handlers where sender and receiver must match.
+- Configuration or feature flags defined in one place and checked in another.
+- Type definitions extended on one side but consumed on the other.
+
+When in doubt, add a finding. A human will verify it. Compiling code is not proof the chain is intact.
+
+## TESTS.md
+
+Check whether this PR removed any Kilo-specific tests.
+
+Kilo-specific tests may live in paths containing `kilo` or `kilocode`, or may include Kilo-specific assertions, fixtures, or `kilocode_change` markers.

.kilo/package-lock.json

@@ -1,376 +0,0 @@
-{
-  "name": ".kilo",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "@kilocode/plugin": "7.2.24"
-      }
-    },
-    "node_modules/@kilocode/plugin": {
-      "version": "7.2.24",
-      "resolved": "https://registry.npmjs.org/@kilocode/plugin/-/plugin-7.2.24.tgz",
-      "integrity": "sha512-b2Xh3N/KaGdYj9hZbzZLKlDHXUsdMey0zL8G+RsnxDQCuhNm46LPyixtlJQhbCyir/zEEvy3uJI9kqKCsOWmQg==",
-      "license": "MIT",
-      "dependencies": {
-        "@kilocode/sdk": "7.2.24",
-        "effect": "4.0.0-beta.48",
-        "zod": "4.1.8"
-      },
-      "peerDependencies": {
-        "@opentui/core": ">=0.1.100",
-        "@opentui/solid": ">=0.1.100"
-      },
-      "peerDependenciesMeta": {
-        "@opentui/core": {
-          "optional": true
-        },
-        "@opentui/solid": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@kilocode/sdk": {
-      "version": "7.2.24",
-      "resolved": "https://registry.npmjs.org/@kilocode/sdk/-/sdk-7.2.24.tgz",
-      "integrity": "sha512-Yos6WeyvMl86OGXLQqQ9YWDm/geAC77xetoptEsS3DLtPVgvz1Nqkvas77fAuAqwkSfGL2mLIiHUTqJUTVflOw==",
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn": "7.0.6"
-      }
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.3.tgz",
-      "integrity": "sha512-QZHtlVgbAdy2zAqNA9Gu1UpIuI8Xvsd1v8ic6B2pZmeFnFcMWiPLfWXh7TVw4eGEZ/C9TH281KwhVoeQUKbyjw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.3.tgz",
-      "integrity": "sha512-mdzd3AVzYKuUmiWOQ8GNhl64/IoFGol569zNRdkLReh6LRLHOXxU4U8eq0JwaD8iFHdVGqSy4IjFL4reoWCDFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.3.tgz",
-      "integrity": "sha512-fg0uy/dG/nZEXfYilKoRe7yALaNmHoYeIoJuJ7KJ+YyU2bvY8vPv27f7UKhGRpY6euFYqEVhxCFZgAUNQBM3nw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.3.tgz",
-      "integrity": "sha512-YxQL+ax0XqBJDZiKimS2XQaf+2wDGVa1enVRGzEvLLVFeqa5kx2bWbtcSXgsxjQB7nRqqIGFIcLteF/sHeVtQg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.3.tgz",
-      "integrity": "sha512-cvwNfbP07pKUfq1uH+S6KJ7dT9K8WOE4ZiAcsrSes+UY55E/0jLYc+vq+DO7jlmqRb5zAggExKm0H7O/CBaesg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.3.tgz",
-      "integrity": "sha512-x0fWaQtYp4E6sktbsdAqnehxDgEc/VwM7uLsRCYWaiGu0ykYdZPiS8zCWdnjHwyiumousxfBm4SO31eXqwEZhQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@standard-schema/spec": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "license": "MIT"
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "license": "Apache-2.0",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/effect": {
-      "version": "4.0.0-beta.48",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-4.0.0-beta.48.tgz",
-      "integrity": "sha512-MMAM/ZabuNdNmgXiin+BAanQXK7qM8mlt7nfXDoJ/Gn9V8i89JlCq+2N0AiWmqFLXjGLA0u3FjiOjSOYQk5uMw==",
-      "license": "MIT",
-      "dependencies": {
-        "@standard-schema/spec": "^1.1.0",
-        "fast-check": "^4.6.0",
-        "find-my-way-ts": "^0.1.6",
-        "ini": "^6.0.0",
-        "kubernetes-types": "^1.30.0",
-        "msgpackr": "^1.11.9",
-        "multipasta": "^0.2.7",
-        "toml": "^4.1.1",
-        "uuid": "^13.0.0",
-        "yaml": "^2.8.3"
-      }
-    },
-    "node_modules/fast-check": {
-      "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.7.0.tgz",
-      "integrity": "sha512-NsZRtqvSSoCP0HbNjUD+r1JH8zqZalyp6gLY9e7OYs7NK9b6AHOs2baBFeBG7bVNsuoukh89x2Yg3rPsul8ziQ==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/dubzzz"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fast-check"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "pure-rand": "^8.0.0"
-      },
-      "engines": {
-        "node": ">=12.17.0"
-      }
-    },
-    "node_modules/find-my-way-ts": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/find-my-way-ts/-/find-my-way-ts-0.1.6.tgz",
-      "integrity": "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA==",
-      "license": "MIT"
-    },
-    "node_modules/ini": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-6.0.0.tgz",
-      "integrity": "sha512-IBTdIkzZNOpqm7q3dRqJvMaldXjDHWkEDfrwGEQTs5eaQMWV+djAhR+wahyNNMAa+qpbDUhBMVt4ZKNwpPm7xQ==",
-      "license": "ISC",
-      "engines": {
-        "node": "^20.17.0 || >=22.9.0"
-      }
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/kubernetes-types": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.30.0.tgz",
-      "integrity": "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/msgpackr": {
-      "version": "1.11.10",
-      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.11.10.tgz",
-      "integrity": "sha512-iCZNq+HszvF+fC3anCm4nBmWEnbeIAfpDs6IStAEKhQ2YSgkjzVG2FF9XJqwwQh5bH3N9OUTUt4QwVN6MLMLtA==",
-      "license": "MIT",
-      "optionalDependencies": {
-        "msgpackr-extract": "^3.0.2"
-      }
-    },
-    "node_modules/msgpackr-extract": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.3.tgz",
-      "integrity": "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "node-gyp-build-optional-packages": "5.2.2"
-      },
-      "bin": {
-        "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
-      },
-      "optionalDependencies": {
-        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3"
-      }
-    },
-    "node_modules/multipasta": {
-      "version": "0.2.7",
-      "resolved": "https://registry.npmjs.org/multipasta/-/multipasta-0.2.7.tgz",
-      "integrity": "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA==",
-      "license": "MIT"
-    },
-    "node_modules/node-gyp-build-optional-packages": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
-      "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "detect-libc": "^2.0.1"
-      },
-      "bin": {
-        "node-gyp-build-optional-packages": "bin.js",
-        "node-gyp-build-optional-packages-optional": "optional.js",
-        "node-gyp-build-optional-packages-test": "build-test.js"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/pure-rand": {
-      "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.0.tgz",
-      "integrity": "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/dubzzz"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fast-check"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/toml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-4.1.1.tgz",
-      "integrity": "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/uuid": {
-      "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.0.tgz",
-      "integrity": "sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/yaml": {
-      "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
-      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
-    "node_modules/zod": {
-      "version": "4.1.8",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}

.kilo/plans/1779979921672-mighty-river.md

@@ -0,0 +1,37 @@
+# Sample Plan With Todos
+
+## Goal
+Create a clear sample plan that breaks work into actionable todos.
+
+## Todos
+
+1. Define the objective
+   - Clarify the desired outcome.
+   - Identify the target audience.
+   - List success criteria.
+
+2. Gather requirements
+   - Collect relevant inputs.
+   - Note constraints and assumptions.
+   - Identify dependencies.
+
+3. Break down the work
+   - Split the goal into smaller tasks.
+   - Prioritize tasks by importance.
+   - Estimate effort for each task.
+
+4. Execute the tasks
+   - Complete the highest-priority items first.
+   - Track progress as todos are finished.
+   - Adjust the plan if new information appears.
+
+5. Review and validate
+   - Check that all todos are complete.
+   - Verify the result matches the goal.
+   - Document any follow-up work.
+
+## Acceptance Criteria
+- The plan has a clear goal.
+- The plan includes a list of actionable todos.
+- The todos are ordered logically.
+- The plan includes a way to confirm completion.

.kilo/plans/1779979972859-crisp-comet.md

@@ -0,0 +1,38 @@
+# Sample Plan With Todos
+
+## Goal
+Create a simple sample plan that demonstrates how to organize work into clear, actionable todos.
+
+## Implementation Steps
+
+1. Define the objective
+   - State the desired outcome in one sentence.
+   - Identify who the plan is for.
+   - List the criteria that indicate success.
+
+2. Gather requirements
+   - Capture relevant inputs and context.
+   - Note constraints, assumptions, and dependencies.
+   - Identify any missing information that may affect execution.
+
+3. Break down the work
+   - Split the objective into smaller tasks.
+   - Order tasks by dependency and priority.
+   - Keep each todo specific enough to complete independently.
+
+4. Execute the todos
+   - Work through the highest-priority tasks first.
+   - Mark todos complete as progress is made.
+   - Update the plan if new information changes the scope.
+
+5. Review the result
+   - Confirm every todo has been addressed.
+   - Verify the result matches the original objective.
+   - Record any follow-up work separately.
+
+## Acceptance Criteria
+
+- The plan has a clear goal.
+- The plan includes actionable todos.
+- The todos are ordered logically.
+- The plan includes a review step to confirm completion.

.kilo/plans/1779980012659-happy-circuit.md

@@ -0,0 +1,37 @@
+# Sample Plan: Add Todo-Based Workflow
+
+## Goal
+Create a small, traceable workflow for implementing a feature with clear todos, validation steps, and completion criteria.
+
+## Scope
+- Identify the affected package or feature area.
+- Make the smallest correct code change.
+- Add or update tests only where they verify behavior.
+- Run the smallest relevant checks before completion.
+
+## Todos
+- [ ] Inspect the relevant files and existing patterns.
+- [ ] Confirm whether the change belongs in Kilo-owned code or shared upstream code.
+- [ ] Implement the minimal code change.
+- [ ] Add or update targeted tests if behavior changes.
+- [ ] Run formatting or linting if the touched package requires it.
+- [ ] Run the smallest relevant typecheck or test command.
+- [ ] Fix any failures introduced by the change.
+- [ ] Summarize changed files and verification results.
+
+## Implementation Notes
+- Prefer Kilo-owned directories for Kilo-specific behavior.
+- If shared upstream files must be edited, keep the change narrow and add `kilocode_change` markers where required.
+- Avoid broad refactors unless they are necessary for the requested behavior.
+- Preserve existing style, naming, and package conventions.
+
+## Verification
+- Run the targeted test for the changed behavior when available.
+- Run the package typecheck if TypeScript code changes.
+- Run any repo-specific guard required by touched files, such as annotation or source-link checks.
+
+## Completion Criteria
+- The requested behavior is implemented.
+- Tests or checks relevant to the change pass, or any inability to run them is documented.
+- No unrelated files are modified.
+- The final response includes a concise summary and verification status.

.kilo/plans/1779980572375-proud-river.md

@@ -0,0 +1,35 @@
+# Sample Plan
+
+## Goal
+Create a small example feature or change using a clear implementation workflow and tracked todo list.
+
+## Scope
+- Add or update a minimal code path.
+- Add focused tests for the changed behavior.
+- Run the smallest relevant verification command.
+- Summarize the result and any follow-up work.
+
+## Todo
+- [ ] Inspect the relevant files and existing patterns.
+- [ ] Identify the smallest safe implementation approach.
+- [ ] Make the code change.
+- [ ] Add or update tests for the behavior.
+- [ ] Run targeted tests or typecheck.
+- [ ] Fix any failures introduced by the change.
+- [ ] Provide a concise final summary with verification results.
+
+## Implementation Notes
+- Prefer the smallest correct change over broad refactors.
+- Preserve existing style and naming conventions.
+- Avoid touching unrelated files.
+- If shared upstream-owned files are involved, use the repository’s `kilocode_change` marker guidance.
+
+## Verification
+Run the most specific applicable check for the touched area, such as:
+- CLI: `bun test ./path/to/test.ts` from `packages/opencode/`
+- VS Code extension: `bun run test:unit` from `packages/kilo-vscode/`
+- Cross-package changes: `bun run typecheck` from the repo root
+
+## Risks
+- The sample scope may need adjustment once the real target files are known.
+- Verification commands depend on which package is touched.

.kilo/plans/1779987162764-misty-rocket.md

@@ -0,0 +1,69 @@
+# Plan: Replace Internal SVGLoader Usage
+
+## Context
+
+The JetBrains plugin currently imports `com.intellij.util.SVGLoader` in `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt` and calls `SVGLoader.load(ByteArrayInputStream(patch()), scale.toFloat())` from `SvgIcon.image(Graphics)`.
+
+Inspection reports this as an internal API usage because `SVGLoader` and its `load(InputStream, float)` method are marked `@ApiStatus.Internal`.
+
+I checked the local IntelliJ source reference via `$INTELLIJ_REPO=/Users/kirillk/products/intellij-community`:
+
+- `platform/util/ui/src/com/intellij/util/SVGLoader.kt`
+- `platform/util/ui/src/com/intellij/ui/svg/svg.kt`
+- `platform/util/ui/src/com/intellij/ui/svg/jsvg.kt`
+- `libraries/jsvg/intellij.libraries.jsvg.iml`
+
+Important findings:
+
+- IntelliJ `SVGLoader.load(stream, scale)` delegates to internal `loadSvg(...)` in `com.intellij.ui.svg`.
+- The actual renderer uses `com.github.weisj:jsvg:2.1.0` and renders into a `BufferedImage` with antialiasing, bicubic interpolation, and pure stroke control.
+- Copying `SVGLoader.kt` directly would keep references to other internal IntelliJ APIs (`IconLoader`, `ScaleContext`, `ImageUtil`, `SvgAttributePatcher`, `createJSvgDocument`, `renderSvgWithSize`, cache classes, etc.) and would be broader than needed.
+
+## Implementation Plan
+
+1. Add Kilo-owned SVG rendering code under the frontend UI package, for example:
+   - `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/ui/SvgLoader.kt`
+   - Package: `ai.kilocode.client.ui`
+   - Suggested internal object name: `SvgLoader`
+
+2. Keep the copied implementation minimal and purpose-specific:
+   - Accept `InputStream` and `scale: Float`.
+   - Parse the SVG with `com.github.weisj.jsvg.parser.SVGLoader().load(stream)` or the equivalent public jsvg API available in version `2.1.0`.
+   - Determine image dimensions from the root SVG `width` and `height` already parsed by existing `SvgIconColorizer.size(...)`, or by passing dimensions into the loader if the public jsvg API does not expose reliable intrinsic size.
+   - Render into `BufferedImage(width * scale, height * scale, BufferedImage.TYPE_INT_ARGB)` using `Graphics2D` rendering hints matching IntelliJ’s `jsvg.kt`:
+     - `KEY_ANTIALIASING = VALUE_ANTIALIAS_ON`
+     - `KEY_INTERPOLATION = VALUE_INTERPOLATION_BICUBIC`
+     - `KEY_STROKE_CONTROL = VALUE_STROKE_PURE`
+   - Return `Image`/`BufferedImage`.
+
+3. If jsvg does not expose intrinsic size cleanly from public API, adjust the API to avoid duplicating SVG parsing:
+   - Add `width` and `height` parameters to the Kilo loader.
+   - In `SvgIcon.image(Graphics)`, call the loader with the already-computed `size.first` and `size.second`.
+   - This is the likely smallest stable solution because current icons already require explicit `width` and `height` for `SvgIconColorizer.size(...)`.
+
+4. Add the jsvg dependency explicitly to the plugin frontend module instead of relying on the IntelliJ-bundled library:
+   - In `packages/kilo-jetbrains/gradle/libs.versions.toml`, add `jsvg = "2.1.0"` and `jsvg = { module = "com.github.weisj:jsvg", version.ref = "jsvg" }`.
+   - In `packages/kilo-jetbrains/frontend/build.gradle.kts`, add `implementation(libs.jsvg)`.
+   - This follows the package instruction to bundle third-party libraries with the plugin rather than relying on IDE-bundled versions.
+
+5. Update `SvgIconColorizer.kt`:
+   - Remove `import com.intellij.util.SVGLoader`.
+   - Replace `SVGLoader.load(ByteArrayInputStream(patch()), scale.toFloat())` with the Kilo-owned loader call.
+   - Keep the existing color patching, cache key, scale calculation, and size parsing intact.
+
+6. Add a focused frontend unit test:
+   - New test file: `frontend/src/test/kotlin/ai/kilocode/client/ui/SvgIconColorizerTest.kt` or `SvgLoaderTest.kt`.
+   - Exercise the actual loader/colorizer with a small SVG resource or inline SVG bytes.
+   - Assert that rendering returns a non-empty image at scale `1f` and `2f`, and that scaled dimensions are correct.
+   - If testing the colorizer, paint the icon into a `BufferedImage` and verify at least one expected patched pixel color appears.
+
+7. Run verification from `packages/kilo-jetbrains/`:
+   - `./gradlew typecheck`
+   - A targeted frontend test if Gradle supports one cleanly, otherwise `./gradlew test`.
+   - The requested DevKit internal API inspection is IDE-based; note in final response that the code no longer references `com.intellij.util.SVGLoader`, and typecheck/tests were run.
+
+## Notes And Risks
+
+- The user said “copy SaveLoaer”; I interpret this as “copy `SVGLoader`”. The implementation should copy the relevant rendering behavior, not IntelliJ’s full internal `SVGLoader` object, because the full source depends on multiple other internal APIs and cache infrastructure.
+- This change is in `packages/kilo-jetbrains/`, a Kilo-owned package, so `kilocode_change` markers are not needed.
+- jsvg package names and constructors should be confirmed during implementation against the downloaded dependency/API available to Gradle. If the API differs from IntelliJ source usage, inspect the source jar or compile error and adapt the minimal wrapper accordingly.

.kilo/plans/1779987392284-clever-river.md

@@ -0,0 +1,60 @@
+# Remove JetBrains SVG Runtime Colorization
+
+## Goal
+Stop runtime SVG recoloring in the JetBrains plugin and rely on IntelliJ's standard light/dark icon asset resolution. Ensure every SVG asset used by the plugin has a light/dark pair.
+
+## Findings
+- Runtime colorization exists only in `frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt`.
+- The only production caller is `frontend/src/main/kotlin/ai/kilocode/client/session/scroll/ScrollButtonIcon.kt`.
+- `ScrollButtonIcon` colorizes two icons at runtime:
+  - `/icons/scroll-bottom.svg`
+  - `/icons/scroll-question.svg`
+- Both already have dark variants:
+  - `scroll-bottom_dark.svg`
+  - `scroll-question_dark.svg`
+- Other used frontend icons already have light/dark pairs:
+  - `send.svg` / `send_dark.svg`
+  - `stop.svg` / `stop_dark.svg`
+  - `shield.svg` / `shield_dark.svg`
+  - `shield-filled.svg` / `shield-filled_dark.svg`
+  - `compress.svg` / `compress_dark.svg`
+  - `chevron-down.svg` / `chevron-down_dark.svg`
+  - `arrow-up.svg` / `arrow-up_dark.svg`
+  - `arrow-down-to-line.svg` / `arrow-down-to-line_dark.svg`
+  - `kilo.svg` / `kilo_dark.svg`
+  - `kilo-content.svg` / `kilo-content_dark.svg`
+  - `plus.svg` / `plus_dark.svg` exists, though no current direct source reference was found.
+  - `kilo@20x20.svg` / `kilo@20x20_dark.svg` exists, though no current direct source reference was found.
+- `src/main/resources/META-INF/pluginIcon.svg` is present and has no `pluginIcon_dark.svg`. It is not referenced in source/XML, but JetBrains treats this filename conventionally as plugin metadata/marketplace icon, so it should be paired for completeness.
+- The SVG assets use literal colors and no `currentColor`, `<style>`, CSS classes, or CSS variables were found in `frontend/src/main/resources/icons/*.svg`.
+
+## Implementation Plan
+1. Replace `ScrollButtonIcon` runtime colorization with standard `IconLoader.getIcon(...)` loading.
+   - Remove imports for `colorizedSvgIcon`, `SessionUiStyle`, `UiStyle`, `JBUI`, and `Color` from `ScrollButtonIcon.kt`.
+   - Add `IconLoader` import.
+   - Load `bottom` with `IconLoader.getIcon("/icons/scroll-bottom.svg", ScrollButtonIcon::class.java)`.
+   - Load `prompt` with `IconLoader.getIcon("/icons/scroll-question.svg", ScrollButtonIcon::class.java)`.
+   - Keep `create(question: Boolean = false)` unchanged so callers continue to receive the appropriate icon.
+   - IntelliJ should automatically resolve `_dark.svg` variants when the look and feel is dark.
+2. Delete `frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt` after confirming no callers remain.
+3. Remove now-unused scroll icon source palette constants from `SessionUiStyle.ScrollIcon`.
+   - Delete the `ScrollIcon` object if no references remain.
+   - This also removes stale comments about runtime colorization.
+4. Add `src/main/resources/META-INF/pluginIcon_dark.svg` as the dark-mode pair for `pluginIcon.svg`.
+   - Use the same artwork/colors as `pluginIcon.svg` unless there is a desired brand-specific dark variant; the current icon already has a black background and yellow mark, so an identical dark pair is acceptable and satisfies IntelliJ's expected pair convention.
+5. Re-scan the JetBrains package after edits.
+   - Confirm there are no `colorizedSvgIcon` or `SvgIconColorizer` references.
+   - Confirm every used SVG path has a sibling `_dark.svg` where IntelliJ expects one.
+   - Confirm no frontend SVG uses `currentColor`, `<style>`, CSS classes, or CSS variables.
+6. Run the smallest relevant verification from `packages/kilo-jetbrains/`:
+   - `bun run typecheck` or `./gradlew typecheck`.
+
+## Files Expected To Change
+- `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/scroll/ScrollButtonIcon.kt`
+- `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/style/SessionUiStyle.kt`
+- Delete `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt`
+- Add `packages/kilo-jetbrains/src/main/resources/META-INF/pluginIcon_dark.svg`
+
+## Risks
+- The scroll icons will no longer follow arbitrary runtime theme colors; they will use the static light/dark SVG asset colors. This matches the requested behavior.
+- If a non-default theme expects palette overrides, static literal SVG colors still follow normal IntelliJ SVG handling better than custom byte-patching, but the exact custom-color behavior may differ from the old colorizer.

.kilo/plans/1779989384508-mighty-cabin.md

@@ -0,0 +1,49 @@
+# Fix JetBrains Session Question Scroll
+
+## Goal
+When a question-like active view first appears in the JetBrains session UI, do not auto-scroll the transcript if the user is already away from the tail and the scroll-to-bottom button is visible. This applies to permission prompts and question-based views. Existing behavior should remain: if the transcript is already at the bottom, new questions/permissions keep the view at the bottom; explicit question navigation can still jump to the active card.
+
+## Current Findings
+- `SessionUi` wires `QuestionView` with:
+  - `follow = { scroll.following() }`
+  - `scroll = { scroll.followBottom(it) }`
+- `QuestionView.show()` runs on first display and calls:
+  - `val tail = follow()` before rendering the card
+  - `scroll(tail)` after rendering
+- `SessionScroll.following()` currently returns `component.viewport.view === messages && tail`.
+- This can use stale internal follow state instead of the live scrollbar state. The user-visible condition is better represented by `SessionScroll.atBottom()`, which is also what `SessionController.beforeUpdate` uses for normal transcript updates.
+- Existing `SessionScrollTest` already covers question and login-required middle-scroll preservation, but it does not cover permission first appearance and likely does not cover a stale-tail/live-not-at-bottom edge.
+
+## Implementation Plan
+1. Update question first-show follow sampling to use live bottom state.
+   - In `SessionUi.buildUi()`, change the `QuestionView` `follow` lambda from `scroll.following()` to `scroll.atBottom()`.
+   - Alternatively, if a single semantic API is preferred, change `SessionScroll.following()` to return `component.viewport.view === messages && atBottom()` and keep the `SessionUi` call site unchanged. Prefer the smaller, clearer call-site change unless tests show other `following()` behavior should change too.
+
+2. Add permission scroll regression tests in `SessionScrollTest`.
+   - Add `test permission appearing at bottom keeps scroll at bottom`.
+   - Add `test permission appearing while user is in middle preserves scroll position`.
+   - Emit `ChatEventDto.PermissionAsked("ses_test", PermissionRequestDto(...))` using the same DTO style as the existing recovered permission test.
+   - Assert the scrollbar value is preserved and `jumpButton().isVisible` stays true when initially away from bottom.
+
+3. Strengthen question regression coverage if needed.
+   - Keep the existing `test question appearing while user is in middle preserves scroll position`.
+   - If the bug reproduces only when the jump button is visible but `tail` can be stale, add a targeted regression that creates the visible jump state before `QuestionAsked` and asserts first display does not jump.
+   - Avoid adding production-only test hooks; use existing `setValue`, `setValuePassive`, `drainScroll`, and event helpers.
+
+4. Preserve intentional explicit navigation behavior.
+   - Do not change `QuestionView.goForward()`, `goBack()`, or `goReview()`, which intentionally call `scroll(true)` and are covered by existing tests that expect navigation to jump to the active question card.
+   - Do not change prompt growth or normal streaming follow behavior unless a failing test shows the same stale-state issue applies there.
+
+5. Verification.
+   - Run the targeted JetBrains frontend session scroll tests from `packages/kilo-jetbrains/` using Gradle test filtering for `SessionScrollTest` if supported.
+   - Run `./gradlew typecheck` from `packages/kilo-jetbrains/` if the targeted tests pass or if Gradle filtering is unavailable.
+   - If Java 21 is unavailable, first check/report that blocker as instructed by the repo docs.
+
+## Expected Files To Touch
+- `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/SessionUi.kt`
+- `packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/session/SessionScrollTest.kt`
+
+## Non-Goals
+- No backend or RPC protocol changes.
+- No redesign of the session scroll algorithm.
+- No changes to explicit question navigation auto-scroll behavior.

.kilo/plans/1779990397226-quiet-canyon.md

@@ -0,0 +1,81 @@
+# Plan: JetBrains Question-Style Scroll Button
+
+## Goal
+
+Fix JetBrains session scrolling so that when any inline prompt card appears while the scroll/jump button is already visible, the transcript scroll position is preserved and only the scroll button state changes. This applies to all current `BaseQuestionView`-backed session cards: questions, permissions, and login-required prompts. Preserve existing behavior that question navigation, review/back/next, and bottom-following content changes auto-scroll when they are supposed to.
+
+## Findings
+
+- The relevant files are `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/SessionUi.kt`, `.../scroll/SessionScroll.kt`, `.../views/question/QuestionView.kt`, `.../views/permission/PermissionView.kt`, `.../views/LoginRequiredView.kt`, `.../views/base/BaseQuestionView.kt`, and `frontend/src/test/kotlin/ai/kilocode/client/session/SessionScrollTest.kt`.
+- `QuestionView`, `PermissionView`, and `LoginRequiredView` do not inherit from `BaseQuestionView`; they compose it as the shared card shell. Scroll behavior should stay outside `BaseQuestionView` because it is a pure visual component with no session scroll context.
+- The current uncommitted `SessionUi.kt` attempt changes `QuestionView` from `follow = { scroll.following() }` to `follow = { scroll.atBottom() }`.
+- That fixes initial question appearance when the user is visibly away from bottom, but it is too broad because `QuestionView.follow()` is also used after custom editor growth, selection refresh, reply/reject, and other internal updates.
+- `QuestionView` already intentionally calls `scroll(true)` in `goBack`, `goForward`, and `goReview`; those forced calls are the behavior that preserves auto-scroll when switching question pages.
+- `PermissionView.show()` and `LoginRequiredView.show()` do not call scroll directly. They rely on `SessionController.beforeUpdate` / `afterUpdate`, which samples `scroll.atBottom()` before the state change and calls `scroll.followBottom(follow)` afterward. With the stale-tail fix, this path can preserve scroll for all non-question inline prompt cards.
+- The uncommitted `SessionScroll.followBottom(false)` change that clears stale `tail` when the transcript is visible and not actually at bottom is directionally correct. It prevents later `following()` calls from resurrecting auto-follow after a non-follow decision.
+- The current scroll button pending state is named `question` / `setQuestionPending` and is only enabled for non-plan `AwaitingQuestion`. To cover all `BaseQuestionView`-backed prompts, this should become a generic pending-input/attention state and include `AwaitingPermission` and `LoginRequired`.
+- Existing behavior intentionally keeps plan follow-up questions using the normal scroll icon (`test plan followup question keeps scroll icon`), so preserve that exception unless product intent changes separately.
+- The uncommitted `build.gradle.kts` and `script/build-sign-check.sh` changes are unrelated to this bug and should not be touched as part of this fix.
+
+## Implementation Plan
+
+1. In `QuestionView.kt`, split the scroll-follow decision into two callbacks.
+
+- Keep the existing `follow` callback for question-internal updates.
+- Add a second callback for initial question appearance, with a default that delegates to `follow` so existing tests/call sites remain compatible.
+- In `show(q)`, sample the new initial callback before making the question visible or rebuilding the card, then call `scroll(tail)` after `syncPage()` as today.
+- Leave `scroll(true)` in `goBack`, `goForward`, and `goReview` unchanged.
+- Leave existing `scroll(follow())` calls in custom editor changes, option selection, reply, and reject paths unchanged.
+
+2. In `SessionUi.kt`, wire the callbacks with distinct meanings.
+
+- Use `follow = { scroll.following() }` for question-internal updates.
+- Use the new initial callback as `{ scroll.atBottom() }` for initial question appearance.
+- Keep `scroll = { scroll.followBottom(it) }`.
+
+3. Generalize the scroll button pending state for all inline prompt cards.
+
+- Rename `SessionScroll.setQuestionPending` and the backing `question` boolean to a generic name such as `setInputPending` / `pending` or `setAttentionPending` / `pending`.
+- Rename `questionPending(state)` in `SessionUi.kt` to match the broader meaning.
+- Return `true` for non-plan `SessionState.AwaitingQuestion`, `SessionState.AwaitingPermission`, and `SessionState.LoginRequired`.
+- Keep returning `false` for plan follow-up questions so the existing plan-specific icon behavior is preserved.
+- Reuse the existing question-style icon and tooltip for now, unless a separate product decision asks for a different permission/login-specific icon or string.
+
+4. In `SessionScroll.kt`, keep the stale-tail reconciliation in `followBottom(false)`.
+
+- When `follow` is false, increment `seq`, and if the active view is the transcript and `!atBottom()`, set `tail = false` before `updateJump()`.
+- Do not change `following()` to use `atBottom()`, because `tail` is needed to preserve bottom-follow behavior across deferred layout/height growth.
+
+5. Do not add scroll callbacks to `PermissionView`, `LoginRequiredView`, or `BaseQuestionView` unless tests prove the controller-level path is insufficient.
+
+- `PermissionView` and `LoginRequiredView` should remain retained visual views that show/hide themselves and refresh their parent.
+- `BaseQuestionView` should stay a scroll-unaware card shell.
+- The shared behavior for those cards should come from the controller-level state-change follow decision plus the generalized pending-button state.
+
+6. In `SessionScrollTest.kt`, update tests around question-style prompt appearance and preserved behavior.
+
+- Keep or add an assertion that the jump button is visible before emitting a question in the middle-scroll test.
+- Keep a regression for stale `tail` plus visible jump button if no public-only scenario can reproduce the failed state; keep the reflective helper local to this test file and avoid adding production test hooks.
+- Keep existing behavior tests for question navigation from the middle, forced navigation resuming follow, custom question answer growth at bottom, custom question answer growth in the middle, and option selection not resuming follow.
+- Add or keep permission bottom/middle tests to prove `AwaitingPermission` preserves scroll when away from bottom and follows when at bottom.
+- Add or keep login-required bottom/middle tests to prove `LoginRequired` preserves scroll when away from bottom and follows when at bottom.
+- Add explicit button-state assertions for permission and login-required while away from bottom: the button remains visible, switches to the pending-input icon/tooltip, and clicking it still scrolls to bottom.
+- Keep the plan follow-up test proving plan prompts do not switch to the pending-input icon.
+
+7. Add a patch changeset for the JetBrains plugin unless an existing branch changeset is intentionally covering this exact fix.
+
+- Suggested release note: `Preserve JetBrains chat scroll position when inline prompts appear while the scroll button is visible.`
+
+## Verification
+
+- From `packages/kilo-jetbrains/`, run `./gradlew test --tests "ai.kilocode.client.session.SessionScrollTest"`.
+- From `packages/kilo-jetbrains/`, run `./gradlew typecheck`.
+- Do not run root `bun test`.
+
+## Expected Outcome
+
+- If the transcript is away from bottom and the jump button is visible, a newly appearing question, permission prompt, or login-required prompt changes the button state without moving `bar.value`.
+- If the transcript is at bottom, a newly appearing question, permission prompt, or login-required prompt follows to the new bottom.
+- Clicking the visible pending-input scroll button still jumps to the bottom for every inline prompt card.
+- Question carousel next/back/review still jumps to the bottom even if the transcript was previously in the middle.
+- Custom question editor growth still follows when the transcript was following and preserves position when it was not.

.kilo/plans/1780256109130-stellar-forest.md

@@ -0,0 +1,109 @@
+# Plan: JetBrains Feedback & Support Button
+
+## Goal
+Add the VS Code empty-state `Feedback & Support` affordance to the JetBrains plugin, including a non-modal popup with the same three destinations:
+
+- GitHub issues: `https://github.com/Kilo-Org/kilocode/issues/new/choose`
+- Discord: `https://kilo.ai/discord`
+- Customer support: `https://kilo.ai/support`
+
+The popup must hide when clicking outside or pressing Escape.
+
+## Findings
+
+- The JetBrains empty state is `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/EmptySessionPanel.kt`.
+- It already renders the logo, welcome copy, recents, and `Show History`; this is the right place to add the button.
+- The VS Code implementation is:
+  - Button: `packages/kilo-vscode/webview-ui/src/components/chat/MessageList.tsx`
+  - Popup content: `packages/kilo-vscode/webview-ui/src/components/chat/FeedbackDialog.tsx`
+  - Styling: `packages/kilo-vscode/webview-ui/src/styles/welcome.css`
+- Local IntelliJ API source is available at `$INTELLIJ_REPO=/Users/kirillk/products/intellij-community`.
+- IntelliJ popup API confirmed in local source:
+  - `JBPopupFactory.getInstance().createComponentPopupBuilder(content, focusComponent)`
+  - `setModalContext(false)` for non-modal context
+  - `setRequestFocus(false)` / `setFocusable(false)` if we want the popup not to steal focus
+  - `setCancelOnClickOutside(true)` for outside-click dismissal
+  - `setCancelKeyEnabled(true)` for Escape dismissal
+  - `setCancelOnWindowDeactivation(true)` and `setCancelOnOtherWindowOpen(true)` are available and appropriate for cleanup
+- IntelliJ platform icons found in `AllIcons`:
+  - Feedback button: `AllIcons.Ide.Feedback`
+  - GitHub action: `AllIcons.Vcs.Vendors.Github`
+  - Support/help action: `AllIcons.Actions.Help` or `AllIcons.General.ContextHelp`
+  - Discord: no platform icon found. Add a Discord icon by borrowing the existing VS Code/kilo-ui Discord SVG artwork and adapting it into the JetBrains plugin resources with IntelliJ-compatible SVG colors and dark variant if needed.
+
+## Implementation Steps
+
+1. Add localized JetBrains bundle keys.
+   - Add base English strings to `frontend/src/main/resources/messages/KiloBundle.properties`:
+     - `feedback.button=Feedback & Support`
+     - `feedback.dialog.message=We'd love to hear your feedback or help with any issues you're experiencing.`
+     - `feedback.dialog.github=Report an issue on GitHub`
+     - `feedback.dialog.discord=Join our Discord community`
+     - `feedback.dialog.support=Customer Support`
+     - Reuse existing cancel text if present; otherwise add `common.cancel=Cancel` only if needed.
+   - Add matching keys to localized `KiloBundle_*.properties` files. If accurate translations are not already available from the VS Code i18n files, copy the VS Code translations for matching locales where practical and leave English fallback only if the JetBrains bundle mechanism supports it cleanly.
+
+2. Extend `EmptySessionPanel` UI.
+   - Add a new retained `FeedbackButton`, styled to match VS Code conceptually:
+     - feedback icon + `Feedback & Support` text
+     - dashed link-colored border
+     - transparent background
+     - hand cursor
+     - hover state fills with link color and flips foreground/background for contrast
+   - Use IntelliJ theme APIs instead of raw colors:
+     - link color: `JBUI.CurrentTheme.Link.Foreground.ENABLED`
+     - hover link color: `JBUI.CurrentTheme.Link.Foreground.HOVERED` if useful
+     - editor/panel background from existing session style or `UiStyle.Colors.editorBackground()` / component background
+     - spacing via `UiStyle.Gap` / `JBUI.Borders`
+     - rounded arc via `UiStyle.Arc.component()` or `JBUI.getInt("Button.arc", 6)` at paint time
+   - Add the feedback button below the existing `Show History` button in the empty-state south area, keeping the current centered layout.
+   - Keep Swing mutations on EDT and preserve retained-component behavior.
+
+3. Implement the feedback popup in frontend Swing code.
+   - Add a small popup builder method/class inside `EmptySessionPanel.kt` or a new nearby UI file if the file would become too large.
+    - Content should mirror VS Code:
+      - Kilo logo at top using existing `/icons/kilo-content.svg`
+      - message text
+      - three action buttons/rows for GitHub, Discord, and Customer Support
+      - every action should have an icon: `AllIcons.Vcs.Vendors.Github` for GitHub, the borrowed Discord SVG for Discord, and `AllIcons.Actions.Help` or `AllIcons.General.ContextHelp` for Customer Support
+      - optional Cancel button if it fits the JetBrains UX; Escape/outside click already dismisses
+   - Add the Discord icon asset under `frontend/src/main/resources/icons/` using the plugin's existing icon naming pattern, for example `discord.svg` and `discord_dark.svg` if the borrowed asset needs separate theme variants.
+   - Load the Discord icon with `IconLoader.getIcon("/icons/discord.svg", EmptySessionPanel::class.java)` or a small Kilo-owned icon object if multiple call sites need it.
+   - Use `BrowserUtil.browse(url)` to open links.
+   - Close the popup after opening a URL.
+   - Use `JBPopupFactory.createComponentPopupBuilder(content, null)` and configure:
+     - `.setModalContext(false)`
+     - `.setRequestFocus(false)`
+     - `.setFocusable(false)` unless keyboard tabbing inside popup is desired; if buttons need keyboard focus, use `.setFocusable(true)` with `.setRequestFocus(false)`
+     - `.setCancelOnClickOutside(true)`
+     - `.setCancelKeyEnabled(true)`
+     - `.setCancelOnWindowDeactivation(true)`
+     - `.setCancelOnOtherWindowOpen(true)`
+     - `.setResizable(false)`
+     - `.setMovable(false)`
+   - Show with `popup.showUnderneathOf(feedbackButton)`.
+
+4. Add test coverage in `EmptySessionPanelTest.kt`.
+   - Assert feedback button text uses `KiloBundle.message("feedback.button")`.
+   - Assert feedback button has hand cursor and visible border semantics.
+   - Add an injectable browse callback or popup action callback only if needed for testing without launching browsers; keep it minimal and avoid production-only test hooks if component traversal can exercise enough behavior.
+   - Add a test that clicking the feedback button creates/shows popup content, if feasible in `BasePlatformTestCase`; otherwise test the retained popup content builder/action rows directly through package-internal methods.
+   - Assert the three action labels exist and URL callbacks map to the same URLs as VS Code.
+   - Assert the Discord action has an icon, so the plan cannot regress to a text-only Discord row.
+
+5. Add release note.
+   - This is user-facing for the JetBrains plugin, so add a patch changeset under `.changeset/` unless the repo has a JetBrains-specific release-note mechanism that supersedes changesets.
+   - Suggested text: `Add Feedback & Support to the JetBrains empty session screen.`
+
+6. Verify.
+   - Run the focused frontend/JetBrains tests first, preferably from `packages/kilo-jetbrains/`:
+     - `./gradlew :frontend:test --tests "ai.kilocode.client.session.ui.EmptySessionPanelTest"`
+   - Run JetBrains typecheck from `packages/kilo-jetbrains/`:
+     - `bun run typecheck` or `./gradlew typecheck`
+   - If touching only frontend UI and tests pass, no backend/SDK generation is needed.
+
+## Notes
+
+- Do not add Kotlin UI DSL, Compose, or JCEF.
+- Do not modify shared opencode files; this work is entirely under `packages/kilo-jetbrains/` plus a changeset.
+- Prefer platform icons where available, but explicitly borrow/add the Discord icon because `AllIcons` does not provide one and the popup should match the VS Code button set visually.

.kilo/plans/jetbrains-mdview-editor-theme-colors.md

@@ -0,0 +1,67 @@
+# JetBrains MdView Editor Theme Colors Plan
+
+## Goal
+
+Keep JetBrains markdown layout compact while making markdown colors and backgrounds come from the active editor color scheme, and ensure existing theme/editor-setting listeners refresh all existing `MdView` instances after changes.
+
+## Findings
+
+- `SessionUi` already subscribes to `EditorColorsManager.TOPIC` and `LafManagerListener.TOPIC`, then calls `applyStyle(SessionEditorStyle.current())` on the session tree.
+- Most markdown consumers already propagate that style through `MdView.applyStyle(style)` via `TextView`, `ReasoningView`, message lists, and session panels.
+- `PlanExitView.applyStyle()` sets only font/code font/foreground and does not call `md.applyStyle(style)`, so internal markdown role colors can stay tied to the initial style.
+- `MdViewHybrid.applyStyle()` restyles retained HTML panes and code block containers, but retained `CodeField` editors need explicit reapplication of `SessionEditorStyle.applyToEditor()` after creation so syntax highlighting and editor colors follow scheme changes.
+- `MdCommon.defaults()` currently mixes editor colors, UI theme colors, and one literal inline-code color fallback. The literal fallback should be removed, and markdown roles should derive from `EditorColorsScheme`/syntax attributes wherever possible.
+- `TextView` currently overrides markdown background with `SessionUiStyle.Transcript.bgColor()` (`UiStyle.Colors.bg()`), while prompt markdown already uses `style.editorBackground`. If markdown surfaces should consistently use editor background, normal text views need to use `style.editorBackground` too.
+
+## Implementation Plan
+
+1. Keep compact CSS unchanged.
+   - Do not reintroduce line-height, margin, padding, heading sizing, or other geometry rules.
+   - Keep the current role color/background selectors only.
+
+2. Derive markdown role defaults from editor settings.
+   - Update `MdCommon.defaults(style)` to use `style.editorForeground` and `style.editorBackground` for primary text/background.
+   - Add small local helper functions for editor attributes, for example foreground/background from `style.editorScheme.getAttributes(key)` and color keys from `style.editorScheme.getColor(key)`.
+   - Use public IntelliJ editor keys for role colors:
+     - Links: `CodeInsightColors.HYPERLINK_ATTRIBUTES.foregroundColor`, fallback to platform link color if absent.
+     - Inline code foreground/background: `DefaultLanguageHighlighterColors.DOC_CODE_INLINE`, fallback to `STRING`, then editor foreground/background.
+     - Code block foreground/background: `DefaultLanguageHighlighterColors.DOC_CODE_BLOCK`, fallback to editor foreground/background.
+     - Quote/emphasis/list weak text: comment/doc-comment attributes, fallback to editor foreground or `UIUtil.getContextHelpForeground()` only when the scheme has no useful value.
+     - Borders/HR/table/code border: editor preview/border color keys such as `EditorColors.PREVIEW_BORDER_COLOR`, fallback to `UiStyle.Colors.contentBorder()`.
+   - Remove `JBColor(0x...)` or other literal runtime color fallbacks from `MdCommon`.
+   - Keep public `MdView` API unchanged; role colors stay internal unless a concrete external override need appears.
+
+3. Ensure style propagation reaches every markdown instance.
+   - Update `PlanExitView.applyStyle(style)` to call `md.applyStyle(style)` before applying its explicit font/code-font/foreground overrides.
+   - Audit existing markdown callers after the change; keep using the existing `SessionEditorStyleTarget` propagation path rather than adding per-`MdView` theme listeners.
+   - Keep explicit foreground overrides in `TextView`, `ReasoningView`, and `PlanExitView` where they intentionally set body text role, but let internal markdown role colors refresh from the new style snapshot.
+
+4. Ensure retained hybrid code blocks update after editor setting changes.
+   - In `MdViewHybrid.CodeView.style(opts)`, for retained `CodeField` blocks, reapply `style.applyToEditor(editor)` to the underlying editor if it exists.
+   - Reapply code editor background/scroll pane/viewport backgrounds from `opts.preBg` in the same path.
+   - Preserve retained component/editor reuse: do not rebuild code block panes just to update style.
+
+5. Align markdown backgrounds with editor settings.
+   - Keep `MdCommon` default background as `style.editorBackground`.
+   - Change normal `TextView` markdown background to `style.editorBackground` if the intent is that all markdown surfaces use editor background, matching `PromptView` and session root behavior.
+   - Preserve `transparent` handling: when `md.opaque = false`, background should still be the editor-derived value for child/code surfaces, but the Swing component should remain non-opaque.
+
+6. Update tests.
+   - Extend `MdViewTest` to verify markdown role CSS changes when applying a `SessionEditorStyle` backed by a customized editor scheme, especially inline code, code block, link, and border colors.
+   - Extend `MdViewHybridTest` to assert `applyStyle()` updates retained HTML panes and retained code editors without replacing them, including editor scheme/background changes.
+   - Add or extend `PlanExitViewTest` so `applyStyle()` refreshes the nested markdown style, not just foreground/font overrides.
+   - Keep existing compactness expectations: tests should not assert new spacing, padding, margin, line-height, or size rules.
+
+## Verification
+
+- From `packages/kilo-jetbrains/`, run `./gradlew frontend:test --tests '*MdView*'`.
+- From `packages/kilo-jetbrains/`, run `./gradlew frontend:test --tests '*PlanExitViewTest*'` if the focused test is not covered by the MdView filter.
+- From `packages/kilo-jetbrains/`, run `bun run typecheck`.
+
+## Constraints
+
+- Do not introduce JCEF, Compose, or Kotlin UI DSL.
+- Do not add new theme/editor listeners in `MdView`; use the existing `SessionUi` listener and `SessionEditorStyleTarget` propagation path.
+- Avoid hardcoded runtime colors in markdown styling; prefer editor scheme attributes/color keys, then platform/theme APIs as non-literal fallbacks.
+- Preserve retained Swing behavior and `MdViewHybrid.sync()` component reuse.
+- Keep the public `MdView` override API stable unless implementation proves a new external override is required.

.kilo/plans/jetbrains-mdview-vscode-styling.md

@@ -0,0 +1,69 @@
+# JetBrains MdView VS Code Styling Plan
+
+## Goal
+
+Improve JetBrains markdown output so assistant/user transcript markdown visually matches the VS Code webview markdown style while keeping the existing Swing/JBHtmlPane + editor-backed code block architecture.
+
+## Findings
+
+- VS Code markdown styling is split across `packages/ui/src/components/markdown.css`, `packages/kilo-ui/src/components/markdown.css`, `packages/kilo-ui/src/styles/vscode-bridge.css`, and message-part overrides.
+- Base VS Code markdown uses 14px sans text, 160% line height, tight first/last margins, same-size medium headings, 12px paragraph spacing, link-colored anchors, compact lists, weak list markers, weak blockquotes with a 2px left border, invisible HR spacing, bordered/padded code blocks, green inline code, and lightly bordered tables.
+- The VS Code theme bridge maps markdown roles to editor/theme tokens: heading/link/list/image use `textLinkForeground`, text/strong/code-block use editor foreground, inline code uses charts/syntax green, quote/emphasis use description foreground, HR uses panel border.
+- JetBrains markdown is rendered by `MdViewHybrid` and `MdViewHtmlPane`, with shared CSS from `MdCommon.rules()` and defaults from `MdCommon.defaults()`.
+- JetBrains currently styles only broad tag font/color, links, code/pre colors, blockquote border/text color, and table border. It lacks VS Code-equivalent spacing, heading/strong/emphasis/list marker/table cell rules, inline-code foreground, blockquote geometry, HR spacing, and code block surface polish.
+- JetBrains fenced code blocks are already stronger than VS Code in one respect: they use `EditorTextField` with real IDE syntax highlighting and streaming retention. Preserve this instead of switching to web/JCEF rendering.
+
+## Implementation Plan
+
+1. Expand JetBrains markdown style tokens.
+   - Add internal fields to `MdStyle` for heading, strong, emphasis, inline code foreground, list marker, HR, table/header, and code block border colors.
+   - Keep the public `MdView` override API stable unless a new external override is clearly needed.
+   - Compute defaults in `MdCommon.defaults(style)` from IntelliJ/editor theme sources and centralized Kilo semantic colors where no platform key matches.
+   - Use `JBColor.namedColor("Kilo.Markdown.*", fallback)` for Kilo-specific markdown palette fallbacks, so themes can override them and runtime code avoids scattered hardcoded colors.
+
+2. Mirror VS Code markdown CSS in `MdCommon.rules()`.
+   - Add root/body wrapping rules: max width behavior, break-word wrapping, base line-height, and first/last-child margin trimming where supported by `JBHtmlPane` CSS.
+   - Add heading rules: same base size, medium/bold weight, role-specific color, line height, and bottom spacing.
+   - Add paragraph, list, list item, nested list, and marker rules. If Swing HTML does not support `::marker`, fall back to `li { color: ... }` plus child text color reset only if supported; otherwise keep list text normal and document the limitation in tests.
+   - Add strong/emphasis colors matching VS Code token roles.
+   - Add anchor styling matching VS Code: themed link color, no forced background, and underline behavior where `JBHtmlPane` supports it.
+   - Add blockquote geometry: 2px left border, 24px vertical margin, 8px left padding, weak text, and normal style.
+   - Add table layout rules: collapse borders, full width where possible, 24px vertical margin, 12px cell padding, weak row borders, stronger header text.
+   - Keep HRs visually hidden but spaced consistently with VS Code if the renderer includes them. `MdViewHybrid` currently filters thematic breaks, so this mainly benefits `MdViewHtmlPane` and future reuse.
+   - Add inline-code foreground and medium font weight. Avoid inline code backgrounds unless the current `JBHtmlPane` configuration already draws them acceptably.
+
+3. Polish JetBrains code block containers without losing IDE highlighting.
+   - Keep `EditorTextField` for fenced/indented blocks and `JBTextArea` fallback.
+   - Style `JBScrollPane` code blocks to match VS Code’s `markdown-code` wrapper feel: subtle background, subtle border, rounded-ish platform arc if feasible, 12px-ish padding, and thin horizontal scrollbar behavior.
+   - Use `SessionUiStyle.View.Code` for geometry constants. Add only minimal new constants there if current values cannot represent the VS Code spacing.
+   - Separate code block border color from table border internally so table styling can change without affecting code boxes.
+   - Continue applying `SessionEditorStyle.applyToEditor(ed)` so code blocks follow IDE syntax highlighting and editor font changes.
+
+4. Add file/path affordance parity where safe.
+   - For markdown links whose `href` looks like a relative file path, keep existing link dispatch so the current caller can open files/URLs appropriately.
+   - Consider decorating inline code that looks like a path with a `file-link` class only when an `openFile` callback is available through the existing usage path. If the current `MdView` abstraction only has `openUrl`, do not widen it unless the call sites can pass file opening cleanly.
+   - At minimum, make inline code/path-looking content visually closer to VS Code by using the inline-code foreground and dotted underline for explicit file links where generated HTML contains link/code classes.
+
+5. Preserve retained Swing behavior.
+   - Keep `MdViewHybrid.sync()` prefix reuse logic unchanged unless necessary.
+   - Ensure style updates call `reloadCssStylesheets()` and reassign text only for retained `JBHtmlPane` blocks, not by rebuilding all blocks.
+   - Keep streaming fenced-code fast path and editor disposal behavior intact.
+
+6. Add focused tests.
+   - Extend `MdViewTest` and/or `MdViewHybridTest` to assert `overrideSheet()` contains the new VS Code-equivalent rules for headings, strong/emphasis, links, inline code foreground, list/table/blockquote spacing, HR, and code block/table border separation.
+   - Add component tests for code block pane styling: background, viewport background, border color, padding, scrollbar policy, and retained editor instance after `applyStyle()`.
+   - Keep existing stress/leak tests green. Add a small stress assertion only if the implementation changes style application semantics.
+   - Add a changeset: `@kilocode/kilo-jetbrains` patch with user-facing wording such as `Improve markdown readability in JetBrains chat transcripts.`
+
+## Verification
+
+- Run targeted JetBrains markdown tests first from `packages/kilo-jetbrains/`: `./gradlew frontend:test --tests '*MdView*'` if the Gradle module supports it; otherwise run the closest supported targeted Gradle test command.
+- Run `bun run typecheck` from `packages/kilo-jetbrains/`.
+- If targeted Gradle filtering is unreliable, run `./gradlew test` from `packages/kilo-jetbrains/`.
+
+## Constraints
+
+- Do not introduce JCEF, Compose, or Kotlin UI DSL.
+- Keep changes inside `packages/kilo-jetbrains/` and `.changeset/` unless a shared Kilo UI source of truth is explicitly required.
+- No `kilocode_change` markers are needed for JetBrains or Kilo UI paths.
+- Prefer IntelliJ theme APIs and centralized semantic tokens over scattered literal colors.

.kilo/plans/jetbrains-session-ui-icons-header.md

@@ -0,0 +1,63 @@
+# JetBrains Session UI Icons And Header Layout Plan
+
+## Goal
+Improve JetBrains session UI icon consistency and reduce accidental header interactions:
+- Use Kilo/VS Code-aligned session icons in session views.
+- Fix the reasoning header icon.
+- Normalize session part collapse/expand chevrons so collapsed/expanded states do not jump between differently sized glyphs.
+- Move the session-details toggle away from compaction and place it before the session title.
+
+## Findings
+- Session view icons are centralized in `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/views/SessionViewIcons.kt` and loaded from `frontend/src/main/resources/icons/views/*.svg`.
+- The JetBrains `views` SVGs already mirror the shared VS Code/UI icon paths from `packages/ui/src/components/icon.tsx` for the audited names, including `brain`, `chevron-down`, `chevron-right`, `checklist`, `console`, `warning`, etc.
+- The reasoning view currently renders `SessionViewIcons.eye` in `ReasoningView.kt`; VS Code/shared UI uses the `brain` icon for reasoning/thinking surfaces, and `SessionViewIcons.brain` already exists.
+- Standard collapsible session parts use `SessionViewIcons.chevronDown` when expanded and `SessionViewIcons.chevronRight` when collapsed in `AbstractSessionPartView.kt`; `QuestionResultView.kt` repeats this pattern manually. The down/right SVG paths have different visual extents.
+- The session header currently places the details toggle next to the compact button in the right-side controls in `SessionHeaderPanel.kt`, making the two actions easy to confuse.
+
+## Implementation Steps
+1. **Keep icon sources aligned with VS Code/shared UI**
+   - Treat `packages/ui/src/components/icon.tsx` as the source for Kilo web/session glyph shapes.
+   - Re-check `SessionViewIcons.kt` entries against available JetBrains assets; only update or add SVGs if a session view uses a Kilo icon missing from `frontend/src/main/resources/icons/views/`.
+   - Preserve JetBrains SVG theming rules: no `currentColor`; use literal palette colors and dark variants where assets are added or changed.
+
+2. **Fix reasoning icon**
+   - In `ReasoningView.kt`, change the reasoning header glyph from `SessionViewIcons.eye` to `SessionViewIcons.brain`.
+   - Add or update test coverage in `ReasoningViewTest.kt` by inspecting the rendered Swing label tree and asserting the reasoning icon is `SessionViewIcons.brain`.
+
+3. **Normalize collapse/expand chevrons for session parts**
+   - Stop using the mixed `chevronRight`/`chevronDown` pair for collapsible session content.
+   - Use a single base Kilo chevron glyph for both states, matching the current custom chevron used by the session header (`/icons/chevron-down.svg` / equivalent `SessionViewIcons.chevronDown`).
+   - Add a shared rotated icon for the opposite state instead of switching to a differently sized right-facing asset. Prefer a small reusable helper or centralized icon field rather than importing header-specific UI into session views.
+   - Update `AbstractSessionPartView.kt` and `QuestionResultView.kt` to use the normalized chevron pair.
+   - Leave `QuestionView.kt` navigation chevrons alone unless auditing shows they are being used for collapse/expand; those are previous/next controls, not expand/collapse controls.
+
+4. **Relocate and change header show/hide details toggle**
+   - In `SessionHeaderPanel.kt`, replace the custom header details chevron with platform `AllIcons` arrows/chevrons, e.g. collapsed = `AllIcons.General.ArrowRight`, expanded = `AllIcons.General.ArrowDown`.
+   - Move the details toggle out of the right-side controls and into `BorderLayout.WEST` of the header row.
+   - Rebuild the top header as:
+     - outer border layout
+     - west: details toggle button
+     - center: inner border layout
+     - inner center: session title
+     - inner east: horizontal stack/row with price/context and compact button
+   - Remove the details toggle from the right-side row so compaction remains visually separate from show/hide details.
+   - Keep existing tooltip/accessibility strings and expansion persistence behavior unchanged.
+
+5. **Tests**
+   - Update `SessionHeaderPanelTest.kt` to assert:
+     - collapsed/expanded header details icons use the selected `AllIcons` constants;
+     - the details toggle persists expansion state as before;
+     - the details toggle is parented/laid out separately from the compact button.
+   - Update `AbstractSessionPartViewTest.kt` to assert collapsible parts keep the same icon dimensions across collapsed/expanded states and no longer use the mismatched right/down pair.
+   - Update `QuestionResultViewTest.kt` similarly because it has its own chevron implementation.
+   - Update `ReasoningViewTest.kt` for the brain icon.
+
+6. **Verification**
+   - Run the smallest relevant JetBrains checks from `packages/kilo-jetbrains/`:
+     - `./gradlew test --tests "ai.kilocode.client.session.views.ReasoningViewTest" --tests "ai.kilocode.client.session.views.base.AbstractSessionPartViewTest" --tests "ai.kilocode.client.session.views.QuestionResultViewTest" --tests "ai.kilocode.client.session.ui.header.SessionHeaderPanelTest"`
+     - `./gradlew typecheck`
+   - If the filtered Gradle test syntax is not accepted by the project, run `./gradlew test` from `packages/kilo-jetbrains/` instead.
+
+## Notes
+- No shared upstream `opencode` files are involved; changes stay under `packages/kilo-jetbrains/`.
+- A changeset may be needed because this is user-facing JetBrains UI polish; confirm existing changeset policy for the private JetBrains package during implementation.

.kilo/skills/gh-issues/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: gh-issues
+description: Use when creating, triaging, or commenting on GitHub issues for the Kilo VS Code extension or JetBrains plugin via `gh`. Covers issue templates, project board assignment, title conventions, and required `gh` scopes.
+---
+
+# GitHub Issues
+
+Use this skill whenever you create or manage a GitHub issue with `gh` for either the VS Code extension or the JetBrains plugin.
+
+## Templates
+
+The repo defines issue templates in `.github/ISSUE_TEMPLATE/`. Pick the matching template instead of opening a blank issue:
+
+| Template | When to use |
+|---|---|
+| `Bug report` (`bug-report.yml`) | Reproducible defects with steps, expected, and actual behavior |
+| `Feature Request` (`feature-request.yml`) | New capabilities, enhancements, or behavior changes |
+| `Question` (`question.yml`) | Usage or design questions that aren't obviously bugs or feature requests |
+
+Pass the template title to `gh issue create --template`.
+
+## Title Conventions
+
+- Use a plain, descriptive title that reads cleanly as a standalone sentence.
+- Do not add platform-specific prefixes such as `[JetBrains]`, `[Jetbrains]`, `[JB]`, `[VS Code]`, `[VSCode]`, or similar. Routing happens through project boards, not the title.
+
+## Project Boards
+
+Every new issue must land on the correct project board:
+
+| Surface | Project | URL |
+|---|---|---|
+| VS Code extension | `VS Code Extension` | https://github.com/orgs/Kilo-Org/projects/25 |
+| JetBrains plugin | `Jetbrains Plugin` | https://github.com/orgs/Kilo-Org/projects/39 |
+
+Pass the project title to `gh issue create --project`.
+
+## Recipes
+
+Create a VS Code extension bug report and add it to the board:
+
+```bash
+gh issue create \
+  --template "Bug report" \
+  --project "VS Code Extension" \
+  --title "Sidebar chat fails to render after reload" \
+  --body "..."
+```
+
+Create a JetBrains feature request:
+
+```bash
+gh issue create \
+  --template "Feature Request" \
+  --project "Jetbrains Plugin" \
+  --title "Support Kotlin Multiplatform target detection" \
+  --body "..."
+```
+
+## Scope Errors
+
+If `gh` reports a missing scope when assigning a project, refresh the auth token and retry:
+
+```bash
+gh auth refresh -s project
+```
+
+After the refresh succeeds, re-run the original `gh issue create` command. Do not fall back to creating the issue without the project — the board assignment is required.

.kilo/skills/kilocode-merge-minimizer/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: kilocode-merge-minimizer
+description: Use when changing shared upstream-owned files, editing or reviewing `kilocode_change` markers, or moving additive Kilo-specific behavior into Kilo-owned code to reduce future merge conflicts.
+---
+
+# Kilo Merge Minimizer
+
+Use this skill whenever a normal development task touches shared upstream-owned code and includes Kilo-specific behavior, especially for marker cleanup, extraction work, or `kilocode_change` annotations.
+
+Do not use this as the primary guide for upstream merge resolution. Upstream merges have their own instructions and should not duplicate that workflow here.
+
+## Goal
+
+Minimize Kilo's long-term diff against upstream OpenCode while preserving behavior.
+
+Prefer this shape for Kilo-specific additions:
+
+1. Shared upstream file contains only a minimal hook, import, call, registration, or config entry.
+2. Kilo-specific behavior lives in Kilo-owned code.
+3. Unavoidable shared-file changes have narrow `kilocode_change` markers.
+4. The annotation checker passes.
+
+For changes to existing upstream behavior, prefer the smallest in-place shared-file diff with narrow markers. Do not move changed upstream logic into Kilo-owned code just to avoid textual conflicts, because that can create harder semantic merge conflicts.
+
+## Core Rules
+
+- Use `script/check-opencode-annotations.ts` as the source of truth for current shared scopes and exempt paths.
+- Use `script/upstream/fix-kilocode-markers.ts` for stale or broad markers, inspecting `--dry-run` output before applying changes.
+- Treat upstream-owned files as shared unless the checker or repo ownership rules exempt them.
+- Put Kilo-owned UI, CLI, runtime logic, and tests in Kilo-owned paths where practical.
+- Avoid adding Kilo business logic directly to shared files.
+- Keep shared-file edits as close as possible to upstream shape.
+- Do not change shared files unless the change is required for Kilo functionality, fixes a Kilo bug, or is a minimal targeted upstream-quality fix.
+- Do not create a large Kilo-only fork for a general upstream-quality improvement. Prefer a minimal targeted fix, or leave the broader change for upstream.
+- Do not duplicate upstream logic unless there is a concrete reason. If duplication is unavoidable, isolate the Kilo delta and keep the upstream dependency obvious.
+
+## Shared File Structure
+
+- Do not refactor, rename, split files, or extract helpers in shared files just to improve readability or make Kilo extraction cleaner.
+- Avoid structural changes that make upstream behavior harder to compare or hide semantic dependency on upstream code.
+
+## Shared File Style
+
+- Preserve upstream formatting and import style in shared files, even when it differs from Kilo style.
+- Put Kilo-only imports on separate marked lines instead of reorganizing upstream imports.
+
+## Decision Rules
+
+Extract Kilo logic when:
+
+- The change is an additive Kilo feature or integration, not a modification of existing upstream behavior.
+- The shared-file change has meaningful Kilo-owned behavior, not just a tiny condition, import, registration, or field.
+- The code has loops, branching, error handling, async workflows, storage access, network calls, UI rendering, or telemetry.
+- The shared file can become a small orchestrator that calls Kilo helpers.
+- The Kilo code is independent enough that extraction will not hide future upstream fixes or behavior changes.
+
+Keep the change inline when:
+
+- The Kilo delta is a single field, import, call, simple condition, or small registry entry.
+- Extraction would reshape upstream code more than the Kilo change itself.
+- The change modifies an upstream algorithm, ordering, heuristic, control flow, or bug fix.
+- Extraction would duplicate upstream logic or hide semantic dependency on upstream behavior.
+- The Kilo helper closes over upstream-local state. Keep closure-scoped helpers inline and contiguous in one narrow marker block.
+- The shared file owns the only route table, enum, schema, switch, or registry where the hook must exist.
+- The change restores upstream shape or removes a stale Kilo divergence.
+
+Always preserve upstream behavior order unless the Kilo behavior change is intentional and tested.
+
+## Marker Rules
+
+- Mark only Kilo-specific diff lines in shared upstream files.
+- Prefer inline markers for single-line changes: `const value = 42 // kilocode_change`.
+- Use block markers only for adjacent Kilo-specific lines:
+
+```ts
+// kilocode_change start
+registerKiloFeature(app)
+// kilocode_change end
+```
+
+- Use the file's native comment style, including JSX block comments inside JSX and `#` comments for YAML, TOML, and shell.
+- Do not add markers in checker-exempt Kilo-owned paths.
+- Remove stale markers when upstream already contains the behavior or when touching Kilo-owned files that still have old markers.
+- Use `// kilocode_change - new file` only for unavoidable new Kilo-specific files inside shared upstream paths.
+
+## Tests
+
+- Put Kilo-specific CLI/runtime tests in Kilo-owned test paths.
+- Move tests out of shared upstream test paths when the behavior under test is Kilo-specific.
+- Tests should cover the real failing path, not private or unstable APIs chosen only for convenience.
+- Do not add skip gates for required regression coverage.
+
+## Verification
+
+After editing shared files or marker comments, run:
+
+```bash
+bun run script/check-opencode-annotations.ts
+```
+
+If the PR uses a non-default comparison base, pass the correct base ref:
+
+```bash
+bun run script/check-opencode-annotations.ts --base <base-ref>
+```
+
+For stale or broad markers in one shared file, inspect the dry run before applying:
+
+```bash
+bun run script/upstream/fix-kilocode-markers.ts <repo-relative-file> --dry-run
+```
+
+Before finishing, confirm:
+
+- Shared files contain minimal integration points only.
+- Kilo logic and tests live in Kilo-owned paths where practical.
+- Markers are narrow.
+- Stale markers are removed.
+- The annotation checker passed, or the reason it could not run is reported.

.kilo/skills/release-jetbrains/SKILL.md

@@ -0,0 +1,172 @@
+---
+name: release-jetbrains
+description: Use when releasing the Kilo JetBrains plugin -- resolve a version ("next rc" or explicit), run the prepare workflow, edit and commit a filtered human-readable changelog on the release PR, then watch publish to completion.
+---
+
+# JetBrains Release
+
+Use this skill when releasing the Kilo JetBrains plugin.
+
+This skill drives the existing JetBrains release workflows. It must not move, delete, or recreate JetBrains release tags. It must always confirm the resolved version with the user before dispatching the prepare workflow because the prepare workflow creates an immutable `jetbrains/v<version>` tag.
+
+## Preconditions
+
+- Run from the repository root.
+- `gh` must be authenticated for `Kilo-Org/kilocode` with permission to dispatch workflows, read PRs, and write contents. Merge permission is only required if the user asks the skill to merge the release PR automatically.
+- Check auth with `gh auth status`. For GitHub CLI OAuth, refresh common release scopes with `gh auth refresh -s repo -s workflow`; `repo` covers private-repo contents and PR operations, and `workflow` allows workflow dispatch. If using a fine-grained token instead, grant repository permissions for Actions read/write, Contents read/write, and Pull requests read/write. Merging still requires normal repository collaborator permission or a token/user allowed by branch protection.
+- Reference `packages/kilo-jetbrains/RELEASING.md` for manual recovery rules.
+- Do not locally check out the generated release branch. The helper scripts update the release branch through GitHub to avoid disturbing the current worktree.
+
+## Version Resolution
+
+Resolve the user's version request:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/resolve-version.ts --spec "next rc"
+```
+
+Accepted specs:
+
+| Spec | Meaning |
+|---|---|
+| `next rc` | If the latest JetBrains tag is an RC, increment its `rc.n`; otherwise start the next patch RC at `rc.1`. |
+| `next stable` | If the latest JetBrains tag is an RC, use its base version; otherwise use the next patch stable. |
+| `x.y.z-rc.n` | Explicit RC release. |
+| `x.y.z` | Explicit stable release. |
+
+Show the resolved `version`, `kind`, and default `fromTagDefault` to the user and ask for confirmation before continuing.
+
+## Prepare Workflow
+
+After confirmation, dispatch and watch the prepare workflow:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/dispatch-prepare.ts --kind rc --version 7.0.1-rc.7
+```
+
+Pass a generous Bash timeout, such as `1800000` ms, because the script blocks on `gh run watch --exit-status`. If the shell times out but the workflow is still running, re-attach with:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/dispatch-prepare.ts --kind rc --version 7.0.1-rc.7 --run-id <run-id>
+```
+
+The script prints `prNumber`, `prUrl`, `runUrl`, and `branch` on success. Immediately show the `prUrl` to the user so they can open the release PR without asking for it later.
+
+## Changelog Draft
+
+Create a changelog draft after the prepare PR exists:
+
+1. Read the PR body with `gh pr view <pr> --json body`.
+2. Extract `JetBrains-From-Tag`, `JetBrains-Tag`, and `## Generated Notes`.
+3. Fetch the release range tags if they are missing locally:
+
+```bash
+git fetch origin refs/tags/<from-tag>:refs/tags/<from-tag> refs/tags/<tag>:refs/tags/<tag>
+```
+
+4. Use the release range and path filter as the primary relevance signal:
+
+```bash
+git log --oneline <from-tag>..<tag> -- packages/opencode packages/kilo-jetbrains
+```
+
+Keep JetBrains and CLI/runtime changes. Drop unrelated VS Code, docs, gateway, telemetry, i18n, desktop, and webview-only changes unless they affect the CLI bundled into the JetBrains plugin.
+
+Rewrite terse commit or PR titles into user-facing bullets grouped under `### Added`, `### Fixed`, and `### Changed`. Keep the exact generated header format:
+
+```markdown
+## [<version>] - <date>
+```
+
+Write the editable draft to:
+
+```text
+packages/kilo-jetbrains/build/release/<version>-changelog.md
+```
+
+Include source context in an HTML comment so it is easy to edit but not shipped:
+
+```markdown
+<!-- CONTEXT - deleted automatically on commit. Source PRs in range:
+- #1234 feat(jetbrains): ... https://github.com/Kilo-Org/kilocode/pull/1234
+- #1235 fix(cli): ... https://github.com/Kilo-Org/kilocode/pull/1235
+-->
+```
+
+Ask the user to edit the file and confirm when done.
+
+## Commit Changelog
+
+After the user confirms the draft is ready, strip the `<!-- CONTEXT ... -->` block into a temporary cleaned file, then commit the cleaned section to the release branch:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/update-changelog.ts --version 7.0.1-rc.7 --file /path/to/clean-section.md
+```
+
+The script updates `packages/kilo-jetbrains/CHANGELOG.md` on `jetbrains/release/v<version>` through the GitHub contents API and commits with:
+
+```text
+docs(jetbrains): edit changelog for v<version>
+```
+
+If `update-changelog.ts` fails with `gh: Not Found (HTTP 404)`, verify the release branch and changelog path with:
+
+```bash
+gh api "repos/Kilo-Org/kilocode/contents/packages/kilo-jetbrains/CHANGELOG.md?ref=jetbrains/release/v<version>"
+```
+
+Then either fix and retry the helper, or perform the equivalent contents API update using `ref` in the query string.
+
+After the changelog commit succeeds, show the release PR URL again and tell the user that the PR needs manual approval and merge before publishing can continue.
+
+## Approve And Publish
+
+Ask the user to approve the release changelog and metadata. Before merging or publishing, verify the PR approval and required checks are green:
+
+```bash
+gh pr view <pr> --json mergeStateStatus,reviewDecision,statusCheckRollup
+gh pr checks <pr> --watch --interval 10
+```
+
+Do not merge or publish while required checks are failing unless the user explicitly gives a maintainer override.
+
+If a required check fails from an apparent flake, rerun only the failed jobs and wait for the run to finish:
+
+```bash
+gh run rerun <run-id> --failed
+gh run watch <run-id> --exit-status
+```
+
+By default, have the user merge the release PR manually in GitHub, then watch the publish workflow:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7
+```
+
+Only merge automatically when the user explicitly asks for it and `gh` has merge permission:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7 --merge
+```
+
+Pass a generous Bash timeout, such as `1800000` ms. If the shell times out, re-attach with:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7 --run-id <run-id>
+```
+
+If `watch-publish.ts --merge` reports that the PR is already merged, or a transient GitHub API `5xx` interrupts publish-run discovery, rerun without `--merge`:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version <version>
+```
+
+Report the Marketplace channel and GitHub Release URL. RC versions publish to the `eap` channel; stable versions publish to the default Marketplace channel.
+
+## Recovery
+
+- If prepare created the tag but failed before creating a PR, rerun prepare for the same version. The existing workflow reuses the tag if it points to the same commit.
+- If a tag points to an unexpected SHA, stop and inspect manually. Do not move or delete release tags casually.
+- If release PR checks fail from an apparent flake, use `gh run rerun <run-id> --failed`, then `gh run watch <run-id> --exit-status` before publishing.
+- If publish fails after merge, rerun the failed workflow only if Marketplace did not already accept the version.
+- If Marketplace succeeds but GitHub Release upload fails, manually create or edit the GitHub Release for `jetbrains/v<version>` using the reviewed changelog.

.kilo/skills/release-jetbrains/script/dispatch-prepare.ts

@@ -0,0 +1,75 @@
+#!/usr/bin/env bun
+
+import { $ } from "bun"
+import { parseArgs } from "util"
+
+const repo = process.env.GH_REPO ?? process.env.GITHUB_REPOSITORY ?? "Kilo-Org/kilocode"
+const workflow = "prepare-jetbrains-release.yml"
+const { values } = parseArgs({
+  args: Bun.argv.slice(2),
+  options: {
+    kind: { type: "string" },
+    version: { type: "string" },
+    "from-tag": { type: "string" },
+    "run-id": { type: "string" },
+    help: { type: "boolean", short: "h", default: false },
+  },
+})
+
+if (values.help) {
+  console.log(
+    `Usage: bun .kilo/skills/release-jetbrains/script/dispatch-prepare.ts --kind <rc|stable> --version <version> [--from-tag <tag>] [--run-id <id>]`,
+  )
+  process.exit(0)
+}
+
+const kind = values.kind
+const ver = values.version
+const branch = `jetbrains/release/v${ver}`
+
+if (kind !== "rc" && kind !== "stable") throw new Error("--kind must be rc or stable")
+if (!ver) throw new Error("--version is required")
+
+const id = values["run-id"] ?? (await dispatch())
+const url = `https://github.com/${repo}/actions/runs/${id}`
+
+console.log(`prepareRunId=${id}`)
+console.log(`runUrl=${url}`)
+
+await $`gh run watch ${id} --repo ${repo} --exit-status`
+
+const pr = (await $`gh pr view ${branch} --repo ${repo} --json number,url`.json()) as { number: number; url: string }
+console.log(
+  JSON.stringify(
+    {
+      prNumber: pr.number,
+      prUrl: pr.url,
+      runUrl: url,
+      branch,
+    },
+    null,
+    2,
+  ),
+)
+
+async function dispatch() {
+  const before = new Set((await runs()).map((run) => run.databaseId))
+  const args = ["workflow", "run", workflow, "--repo", repo, "-f", `kind=${kind}`, "-f", `version=${ver}`]
+  if (values["from-tag"]) args.push("-f", `from_tag=${values["from-tag"]}`)
+  await $`gh ${args}`
+
+  for (const _ of Array.from({ length: 60 })) {
+    const run = (await runs()).find((item) => !before.has(item.databaseId))
+    if (run) return String(run.databaseId)
+    await Bun.sleep(1000)
+  }
+  throw new Error(`No new ${workflow} run appeared after dispatch`)
+}
+
+async function runs() {
+  return (await $`gh run list --repo ${repo} --workflow ${workflow} --event workflow_dispatch --json databaseId,createdAt,status --limit 100`.json()) as {
+    databaseId: number
+    createdAt: string
+    status: string
+  }[]
+}

.kilo/skills/release-jetbrains/script/resolve-version.ts

@@ -0,0 +1,109 @@
+#!/usr/bin/env bun
+
+import { $ } from "bun"
+import semver from "semver"
+import { parseArgs } from "util"
+
+const { values } = parseArgs({
+  args: Bun.argv.slice(2),
+  options: {
+    spec: { type: "string" },
+    help: { type: "boolean", short: "h", default: false },
+  },
+})
+
+if (values.help) {
+  console.log(
+    `Usage: bun .kilo/skills/release-jetbrains/script/resolve-version.ts --spec <next rc|next stable|version>`,
+  )
+  process.exit(0)
+}
+
+const spec = values.spec?.trim().toLowerCase()
+if (!spec) throw new Error("--spec is required")
+
+await $`git fetch origin main --tags`.quiet()
+
+const tags = await list()
+const hit = explicit(spec) ?? next(spec, tags)
+const from = base(hit.version, hit.kind, tags)
+
+console.log(
+  JSON.stringify(
+    {
+      version: hit.version,
+      kind: hit.kind,
+      fromTagDefault: from,
+    },
+    null,
+    2,
+  ),
+)
+
+type Kind = "rc" | "stable"
+type Tag = { tag: string; version: string }
+
+function explicit(spec: string) {
+  if (/^\d+\.\d+\.\d+-rc\.\d+$/.test(spec)) return { version: spec, kind: "rc" as Kind }
+  if (/^\d+\.\d+\.\d+$/.test(spec)) return { version: spec, kind: "stable" as Kind }
+  return undefined
+}
+
+function next(spec: string, tags: Tag[]) {
+  const latest = [...tags].sort((a, b) => semver.rcompare(a.version, b.version))[0]
+  if (!latest) throw new Error("No JetBrains release tags found; pass an explicit version")
+  const parsed = semver.parse(latest.version)
+  if (!parsed) throw new Error(`Invalid latest JetBrains tag: ${latest.tag}`)
+
+  if (spec === "next rc") return rc(parsed)
+  if (spec === "next stable") return stable(parsed)
+  throw new Error("--spec must be 'next rc', 'next stable', x.y.z-rc.n, or x.y.z")
+}
+
+function rc(ver: semver.SemVer) {
+  const pre = ver.prerelease
+  if (pre[0] === "rc" && typeof pre[1] === "number") {
+    return { version: `${ver.major}.${ver.minor}.${ver.patch}-rc.${pre[1] + 1}`, kind: "rc" as Kind }
+  }
+  return { version: `${ver.major}.${ver.minor}.${ver.patch + 1}-rc.1`, kind: "rc" as Kind }
+}
+
+function stable(ver: semver.SemVer) {
+  if (ver.prerelease.length) return { version: `${ver.major}.${ver.minor}.${ver.patch}`, kind: "stable" as Kind }
+  return { version: `${ver.major}.${ver.minor}.${ver.patch + 1}`, kind: "stable" as Kind }
+}
+
+function base(ver: string, kind: Kind, tags: Tag[]) {
+  const want = semver.parse(ver)
+  if (!want) throw new Error(`Invalid semver: ${ver}`)
+  const prior = tags
+    .filter((item) => !semver.prerelease(item.version) && semver.lt(item.version, ver))
+    .sort((a, b) => semver.rcompare(a.version, b.version))
+
+  if (kind === "stable") {
+    const hit = prior[0]
+    if (!hit) return null
+    return hit.tag
+  }
+
+  const prerelease = tags
+    .filter((item) => {
+      const parsed = semver.parse(item.version)
+      if (!parsed) return false
+      if (parsed.major !== want.major || parsed.minor !== want.minor || parsed.patch !== want.patch) return false
+      return Boolean(semver.prerelease(item.version)) && semver.lt(item.version, ver)
+    })
+    .sort((a, b) => semver.rcompare(a.version, b.version))
+
+  return (prerelease[0] ?? prior[0])?.tag ?? null
+}
+
+async function list() {
+  const text = await $`git tag --list ${"jetbrains/v*"}`.text()
+  return text
+    .split(/\r?\n/)
+    .map((item) => item.trim())
+    .filter(Boolean)
+    .map((tag) => ({ tag, version: tag.replace(/^jetbrains\/v/, "") }))
+    .filter((item) => semver.valid(item.version))
+}

.kilo/skills/release-jetbrains/script/update-changelog.ts

@@ -0,0 +1,84 @@
+#!/usr/bin/env bun
+
+import { $ } from "bun"
+import { parseArgs } from "util"
+
+const repo = process.env.GH_REPO ?? process.env.GITHUB_REPOSITORY ?? "Kilo-Org/kilocode"
+const path = "packages/kilo-jetbrains/CHANGELOG.md"
+const { values } = parseArgs({
+  args: Bun.argv.slice(2),
+  options: {
+    version: { type: "string" },
+    file: { type: "string" },
+    help: { type: "boolean", short: "h", default: false },
+  },
+})
+
+if (values.help) {
+  console.log(
+    `Usage: bun .kilo/skills/release-jetbrains/script/update-changelog.ts --version <version> --file <section.md>`,
+  )
+  process.exit(0)
+}
+
+const ver = values.version
+const file = values.file
+if (!ver) throw new Error("--version is required")
+if (!file) throw new Error("--file is required")
+
+const branch = `jetbrains/release/v${ver}`
+const section = strip((await Bun.file(file).text()).trim())
+validate(section, ver)
+
+const current = (await $`gh api ${`repos/${repo}/contents/${path}?ref=${encodeURIComponent(branch)}`}`.json()) as {
+  content: string
+  encoding: string
+  sha: string
+}
+if (current.encoding !== "base64") throw new Error(`Unexpected content encoding: ${current.encoding}`)
+
+const text = Buffer.from(current.content.replace(/\s/g, ""), "base64").toString("utf8")
+const pattern = regex(ver)
+if (!pattern.test(text)) throw new Error(`${path} is missing a section for ${ver} on ${branch}`)
+
+const next =
+  text
+    .replace(pattern, `\n${section}\n`)
+    .replace(/\n{3,}/g, "\n\n")
+    .trimEnd() + "\n"
+if (next === text) {
+  console.log("CHANGELOG.md already contains the provided section")
+  process.exit(0)
+}
+
+const body = {
+  message: `docs(jetbrains): edit changelog for v${ver}`,
+  content: Buffer.from(next).toString("base64"),
+  sha: current.sha,
+  branch,
+}
+const tmp = await temp(body)
+await $`gh api ${`repos/${repo}/contents/${path}`} --method PUT --input ${tmp}`
+console.log(`Committed changelog update to ${branch}`)
+
+function strip(text: string) {
+  return text.replace(/<!--\s*CONTEXT[\s\S]*?-->/g, "").trim()
+}
+
+function validate(section: string, ver: string) {
+  if (!section.startsWith(`## [${ver}]`)) throw new Error(`Section must start with ## [${ver}]`)
+  if (!/^### (Added|Fixed|Changed)$/m.test(section)) {
+    throw new Error("Section must contain at least one Added, Fixed, or Changed heading")
+  }
+}
+
+function regex(ver: string) {
+  const safe = ver.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+  return new RegExp(`\n?## \\[${safe}\\][\\s\\S]*?(?=\n## \\[|$)`)
+}
+
+async function temp(body: object) {
+  const file = `/tmp/kilo-jetbrains-changelog-${Date.now()}.json`
+  await Bun.write(file, JSON.stringify(body))
+  return file
+}

.kilo/skills/release-jetbrains/script/watch-publish.ts

@@ -0,0 +1,128 @@
+#!/usr/bin/env bun
+
+import { $ } from "bun"
+import { parseArgs } from "util"
+
+const repo = process.env.GH_REPO ?? process.env.GITHUB_REPOSITORY ?? "Kilo-Org/kilocode"
+const workflow = "publish-jetbrains.yml"
+const { values } = parseArgs({
+  args: Bun.argv.slice(2),
+  options: {
+    pr: { type: "string" },
+    version: { type: "string" },
+    merge: { type: "boolean", default: false },
+    "run-id": { type: "string" },
+    help: { type: "boolean", short: "h", default: false },
+  },
+})
+
+if (values.help) {
+  console.log(
+    `Usage: bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version <version> [--merge] [--run-id <id>]`,
+  )
+  process.exit(0)
+}
+
+const pr = values.pr
+const ver = values.version
+if (!pr) throw new Error("--pr is required")
+if (!ver) throw new Error("--version is required")
+
+const branch = `jetbrains/release/v${ver}`
+const id = values["run-id"] ?? (values.merge ? await merge() : await find())
+const url = `https://github.com/${repo}/actions/runs/${id}`
+
+console.log(`publishRunId=${id}`)
+console.log(`runUrl=${url}`)
+
+await $`gh run watch ${id} --repo ${repo} --exit-status`
+
+const rel = await retry(
+  async () =>
+    (await $`gh release view ${`jetbrains/v${ver}`} --repo ${repo} --json url,isPrerelease`.json()) as {
+      url: string
+      isPrerelease: boolean
+    },
+  "view release",
+)
+console.log(
+  JSON.stringify(
+    {
+      version: ver,
+      marketplaceChannel: rel.isPrerelease ? "eap" : "default",
+      releaseUrl: rel.url,
+      runUrl: url,
+    },
+    null,
+    2,
+  ),
+)
+
+async function merge() {
+  const before = new Set((await runs()).map((run) => run.databaseId))
+  try {
+    await $`gh pr merge ${pr} --repo ${repo} --merge`
+  } catch (err) {
+    if (await merged()) {
+      console.warn(`PR ${pr} is already merged; looking for the publish workflow run`)
+      return await find()
+    }
+    throw err
+  }
+
+  for (const _ of Array.from({ length: 120 })) {
+    const run = (await runs()).find((item) => item.headBranch === branch && !before.has(item.databaseId))
+    if (run) return String(run.databaseId)
+    await Bun.sleep(1000)
+  }
+  throw new Error(`No new ${workflow} run appeared after merging PR ${pr}`)
+}
+
+async function find() {
+  for (const _ of Array.from({ length: 120 })) {
+    const run = (await runs()).find((item) => item.headBranch === branch)
+    if (run) return String(run.databaseId)
+    await Bun.sleep(1000)
+  }
+  throw new Error(`No ${workflow} run found for ${branch}. Merge PR ${pr} first, or pass --merge to merge it automatically.`)
+}
+
+async function merged() {
+  const info = await retry(
+    async () => (await $`gh pr view ${pr} --repo ${repo} --json state`.json()) as { state: string },
+    "check PR state",
+  )
+  return info.state === "MERGED"
+}
+
+async function runs() {
+  return await retry(
+    async () =>
+      (await $`gh run list --repo ${repo} --workflow ${workflow} --event pull_request --json databaseId,createdAt,headBranch,status --limit 100`.json()) as {
+        databaseId: number
+        createdAt: string
+        headBranch: string
+        status: string
+      }[],
+    "list workflow runs",
+  )
+}
+
+async function retry<T>(task: () => Promise<T>, label: string, tries = 5): Promise<T> {
+  try {
+    return await task()
+  } catch (err) {
+    if (tries <= 1 || !transient(err)) throw err
+    console.warn(`${label} failed with a transient GitHub error; retrying (${tries - 1} left): ${message(err)}`)
+    await Bun.sleep(2000)
+    return await retry(task, label, tries - 1)
+  }
+}
+
+function transient(err: unknown) {
+  return /\bHTTP 5\d\d\b|\b50[234]\b|Bad Gateway|Gateway Timeout|Service Unavailable/i.test(message(err))
+}
+
+function message(err: unknown) {
+  return err instanceof Error ? err.message : String(err)
+}

.kilocode/package-lock.json

@@ -1,376 +0,0 @@
-{
-  "name": ".kilocode",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "@kilocode/plugin": "7.2.24"
-      }
-    },
-    "node_modules/@kilocode/plugin": {
-      "version": "7.2.24",
-      "resolved": "https://registry.npmjs.org/@kilocode/plugin/-/plugin-7.2.24.tgz",
-      "integrity": "sha512-b2Xh3N/KaGdYj9hZbzZLKlDHXUsdMey0zL8G+RsnxDQCuhNm46LPyixtlJQhbCyir/zEEvy3uJI9kqKCsOWmQg==",
-      "license": "MIT",
-      "dependencies": {
-        "@kilocode/sdk": "7.2.24",
-        "effect": "4.0.0-beta.48",
-        "zod": "4.1.8"
-      },
-      "peerDependencies": {
-        "@opentui/core": ">=0.1.100",
-        "@opentui/solid": ">=0.1.100"
-      },
-      "peerDependenciesMeta": {
-        "@opentui/core": {
-          "optional": true
-        },
-        "@opentui/solid": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@kilocode/sdk": {
-      "version": "7.2.24",
-      "resolved": "https://registry.npmjs.org/@kilocode/sdk/-/sdk-7.2.24.tgz",
-      "integrity": "sha512-Yos6WeyvMl86OGXLQqQ9YWDm/geAC77xetoptEsS3DLtPVgvz1Nqkvas77fAuAqwkSfGL2mLIiHUTqJUTVflOw==",
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn": "7.0.6"
-      }
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.3.tgz",
-      "integrity": "sha512-QZHtlVgbAdy2zAqNA9Gu1UpIuI8Xvsd1v8ic6B2pZmeFnFcMWiPLfWXh7TVw4eGEZ/C9TH281KwhVoeQUKbyjw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.3.tgz",
-      "integrity": "sha512-mdzd3AVzYKuUmiWOQ8GNhl64/IoFGol569zNRdkLReh6LRLHOXxU4U8eq0JwaD8iFHdVGqSy4IjFL4reoWCDFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.3.tgz",
-      "integrity": "sha512-fg0uy/dG/nZEXfYilKoRe7yALaNmHoYeIoJuJ7KJ+YyU2bvY8vPv27f7UKhGRpY6euFYqEVhxCFZgAUNQBM3nw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.3.tgz",
-      "integrity": "sha512-YxQL+ax0XqBJDZiKimS2XQaf+2wDGVa1enVRGzEvLLVFeqa5kx2bWbtcSXgsxjQB7nRqqIGFIcLteF/sHeVtQg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.3.tgz",
-      "integrity": "sha512-cvwNfbP07pKUfq1uH+S6KJ7dT9K8WOE4ZiAcsrSes+UY55E/0jLYc+vq+DO7jlmqRb5zAggExKm0H7O/CBaesg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.3.tgz",
-      "integrity": "sha512-x0fWaQtYp4E6sktbsdAqnehxDgEc/VwM7uLsRCYWaiGu0ykYdZPiS8zCWdnjHwyiumousxfBm4SO31eXqwEZhQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@standard-schema/spec": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "license": "MIT"
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "license": "Apache-2.0",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/effect": {
-      "version": "4.0.0-beta.48",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-4.0.0-beta.48.tgz",
-      "integrity": "sha512-MMAM/ZabuNdNmgXiin+BAanQXK7qM8mlt7nfXDoJ/Gn9V8i89JlCq+2N0AiWmqFLXjGLA0u3FjiOjSOYQk5uMw==",
-      "license": "MIT",
-      "dependencies": {
-        "@standard-schema/spec": "^1.1.0",
-        "fast-check": "^4.6.0",
-        "find-my-way-ts": "^0.1.6",
-        "ini": "^6.0.0",
-        "kubernetes-types": "^1.30.0",
-        "msgpackr": "^1.11.9",
-        "multipasta": "^0.2.7",
-        "toml": "^4.1.1",
-        "uuid": "^13.0.0",
-        "yaml": "^2.8.3"
-      }
-    },
-    "node_modules/fast-check": {
-      "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.7.0.tgz",
-      "integrity": "sha512-NsZRtqvSSoCP0HbNjUD+r1JH8zqZalyp6gLY9e7OYs7NK9b6AHOs2baBFeBG7bVNsuoukh89x2Yg3rPsul8ziQ==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/dubzzz"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fast-check"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "pure-rand": "^8.0.0"
-      },
-      "engines": {
-        "node": ">=12.17.0"
-      }
-    },
-    "node_modules/find-my-way-ts": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/find-my-way-ts/-/find-my-way-ts-0.1.6.tgz",
-      "integrity": "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA==",
-      "license": "MIT"
-    },
-    "node_modules/ini": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-6.0.0.tgz",
-      "integrity": "sha512-IBTdIkzZNOpqm7q3dRqJvMaldXjDHWkEDfrwGEQTs5eaQMWV+djAhR+wahyNNMAa+qpbDUhBMVt4ZKNwpPm7xQ==",
-      "license": "ISC",
-      "engines": {
-        "node": "^20.17.0 || >=22.9.0"
-      }
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/kubernetes-types": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.30.0.tgz",
-      "integrity": "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/msgpackr": {
-      "version": "1.11.10",
-      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.11.10.tgz",
-      "integrity": "sha512-iCZNq+HszvF+fC3anCm4nBmWEnbeIAfpDs6IStAEKhQ2YSgkjzVG2FF9XJqwwQh5bH3N9OUTUt4QwVN6MLMLtA==",
-      "license": "MIT",
-      "optionalDependencies": {
-        "msgpackr-extract": "^3.0.2"
-      }
-    },
-    "node_modules/msgpackr-extract": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.3.tgz",
-      "integrity": "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "node-gyp-build-optional-packages": "5.2.2"
-      },
-      "bin": {
-        "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
-      },
-      "optionalDependencies": {
-        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3"
-      }
-    },
-    "node_modules/multipasta": {
-      "version": "0.2.7",
-      "resolved": "https://registry.npmjs.org/multipasta/-/multipasta-0.2.7.tgz",
-      "integrity": "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA==",
-      "license": "MIT"
-    },
-    "node_modules/node-gyp-build-optional-packages": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
-      "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "detect-libc": "^2.0.1"
-      },
-      "bin": {
-        "node-gyp-build-optional-packages": "bin.js",
-        "node-gyp-build-optional-packages-optional": "optional.js",
-        "node-gyp-build-optional-packages-test": "build-test.js"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/pure-rand": {
-      "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.0.tgz",
-      "integrity": "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/dubzzz"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fast-check"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/toml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-4.1.1.tgz",
-      "integrity": "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/uuid": {
-      "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.0.tgz",
-      "integrity": "sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/yaml": {
-      "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
-      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
-    "node_modules/zod": {
-      "version": "4.1.8",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    }
-  }
-}

.opencode-version

@@ -0,0 +1 @@
+v1.15.9

.opencode/agent/triage.md

@@ -1,7 +1,7 @@
 ---
 mode: primary
 hidden: true
-model: kilo/minimax/minimax-m2.5
+model: kilo/openai/gpt-5-nano # kilocode_change
 color: "#44BA81"
 tools:
   "*": false
@@ -14,95 +14,38 @@ Use your github-triage tool to triage issues.
 
 This file is the source of truth for ownership/routing rules.
 
-## Labels
+Assign issues by choosing the team with the strongest overlap. The github-triage tool will assign a random member from that team.
 
-### windows
+Do not add labels to issues. Only assign an owner.
 
-Use for any issue that mentions Windows (the OS). Be sure they are saying that they are on Windows.
+When calling github-triage, pass one of these team values: tui, desktop_web, core, inference, windows, jetbrains, extension
 
-- Use if they mention WSL too
+## Teams
 
-#### perf
+### TUI
 
-Performance-related issues:
+Terminal UI issues, including rendering, keybindings, scrolling, terminal compatibility, SSH behavior, crashes in the TUI, and low-level TUI performance.
 
-- Slow performance
-- High RAM usage
-- High CPU usage
+### Desktop / Web
 
-**Only** add if it's likely a RAM or CPU issue. **Do not** add for LLM slowness.
+Desktop application and browser-based app issues, including `opencode web`, desktop-specific UI behavior, packaging, and web view problems.
 
-#### nix
+### Core
 
-**Only** add if the issue explicitly mentions nix.
+Core opencode server and harness issues, including sqlite, snapshots, memory, API behavior, agent context construction, tool execution, provider integrations, model behavior, documentation, and larger architectural features.
 
-If the issue does not mention nix, do not add nix.
+### Inference
 
-If the issue mentions nix, assign to `catrielmuller`.
+Kilo Provider, Provider implementation, and billing issues.
 
-#### core
+### Windows
 
-Use for core server issues in `packages/opencode/`, excluding `packages/opencode/src/cli/cmd/tui/`.
+Windows-specific issues, including native Windows behavior, WSL interactions, path handling, shell compatibility, and installation or runtime problems that only happen on Windows.
 
-Examples:
+### Jetbrains
 
-- LSP server behavior
-- Harness behavior (agent + tools)
-- Feature requests for server behavior
-- Agent context construction
-- API endpoints
-- Provider integration issues
-- New, broken, or poor-quality models
+Jetbrains extension related issues.
 
-#### vscode
+### Extension
 
-Use for issues related to the VS Code extension in `packages/kilo-vscode/`.
-
-#### gateway
-
-Use for issues related to the Kilo Gateway in `packages/kilo-gateway/`.
-
-When assigning to people here are the following rules:
-
-Nix:
-ONLY assign if the issue will have the "nix" label.
-
-- catrielmuller
-
-Models / Providers:
-Use for issues about model quality, provider integrations, or broken/new models.
-
-- chrarnoldus
-
-Cloud Agents:
-Use for issues about cloud agent behavior or infrastructure.
-
-- pandemicsyn
-- eshurakov
-
-Core (`packages/opencode/...`):
-
-- kevinvandijk
-- marius-kilocode
-- catrielmuller
-
-VSCode Extension (`packages/kilo-vscode/...`):
-
-- markijbema
-
-Kilo Gateway (`packages/kilo-gateway/...`):
-
-- jrf0110
-
-Windows:
-
-- catrielmuller (assign any issue that mentions Windows or is likely Windows-specific)
-
-Determinism rules:
-
-- If "nix" label is added but title + body does not mention nix/nixos, the tool will drop "nix"
-- If title + body mentions nix/nixos, assign to `catrielmuller`
-- If "vscode" label is added, assign to `markijbema`
-- If "gateway" label is added, assign to `jrf0110`
-
-In all other cases, choose the team/section with the most overlap with the issue and assign a member from that team at random.
+VSCode Extension related issues.

.opencode/command/changelog.md

@@ -18,9 +18,12 @@ Do not use `git log` or author metadata when deciding attribution.
 
 Rules:
 
-- Write the final file with sections in this order:
+- Write the final file with release sections in this order:
   `## Core`, `## TUI`, `## Desktop`, `## SDK`, `## Extensions`
 - Only include sections that have at least one notable entry
+- Within each release section, keep bug fixes grouped under `### Bugfixes`
+- Keep other notable entries under `### Improvements` when a section has bug fixes too
+- Omit empty subsections
 - Keep one bullet per commit you keep
 - Skip commits that are entirely internal, CI, tests, refactors, or otherwise not user-facing
 - Start each bullet with a capital letter

.opencode/opencode.jsonc

@@ -18,4 +18,5 @@
     "github-triage": false,
     "github-pr-search": false,
   },
+  "disabled_providers": [],
 }

.opencode/plugins/tui-smoke.tsx

@@ -1,35 +1,62 @@
 /** @jsxImportSource @opentui/solid */
-import { useKeyboard, useTerminalDimensions, type JSX } from "@opentui/solid"
-import { RGBA, VignetteEffect } from "@opentui/core"
-import type {
-  TuiKeybindSet,
-  TuiPlugin,
-  TuiPluginApi,
-  TuiPluginMeta,
-  TuiPluginModule,
-  TuiSlotPlugin,
-} from "@opencode-ai/plugin/tui"
+import { useTerminalDimensions, type JSX } from "@opentui/solid"
+import { useBindings, useKeymapSelector } from "@opentui/keymap/solid"
+import { RGBA, VignetteEffect, type KeyEvent, type Renderable } from "@opentui/core"
+import { createBindingLookup, type BindingConfig } from "@opentui/keymap/extras"
+import type { TuiPlugin, TuiPluginApi, TuiPluginMeta, TuiPluginModule, TuiSlotPlugin } from "@opencode-ai/plugin/tui"
 
 const tabs = ["overview", "counter", "help"]
-const bind = {
-  modal: "ctrl+shift+m",
-  screen: "ctrl+shift+o",
-  home: "escape,ctrl+h",
-  left: "left,h",
-  right: "right,l",
-  up: "up,k",
-  down: "down,j",
-  alert: "a",
-  confirm: "c",
-  prompt: "p",
-  select: "s",
-  modal_accept: "enter,return",
-  modal_close: "escape",
-  dialog_close: "escape",
-  local: "x",
-  local_push: "enter,return",
-  local_close: "q,backspace",
-  host: "z",
+const command = {
+  modal: "smoke_modal",
+  screen: "smoke_screen",
+  alert: "smoke_alert",
+  confirm: "smoke_confirm",
+  prompt: "smoke_prompt",
+  select: "smoke_select",
+  host: "smoke_host",
+  home: "smoke_home",
+  toast: "smoke_toast",
+  dialog_close: "smoke_dialog_close",
+  local_push: "smoke_local_push",
+  local_pop: "smoke_local_pop",
+  screen_home: "smoke_screen_home",
+  screen_left: "smoke_screen_left",
+  screen_right: "smoke_screen_right",
+  screen_up: "smoke_screen_up",
+  screen_down: "smoke_screen_down",
+  screen_modal: "smoke_screen_modal",
+  screen_local: "smoke_screen_local",
+  screen_host: "smoke_screen_host",
+  screen_alert: "smoke_screen_alert",
+  screen_confirm: "smoke_screen_confirm",
+  screen_prompt: "smoke_screen_prompt",
+  screen_select: "smoke_screen_select",
+  modal_accept: "smoke_modal_accept",
+  modal_close: "smoke_modal_close",
+}
+
+type SmokeBindings = BindingConfig<Renderable, KeyEvent>
+
+const defaultKeymap = {
+  [command.modal]: "ctrl+shift+m",
+  [command.screen]: "ctrl+shift+o",
+  [command.dialog_close]: "escape",
+  [command.local_push]: "enter,return",
+  [command.local_pop]: "escape,q,backspace",
+  [command.screen_home]: "escape,ctrl+h",
+  [command.screen_left]: "left,h",
+  [command.screen_right]: "right,l",
+  [command.screen_up]: "up,k",
+  [command.screen_down]: "down,j",
+  [command.screen_modal]: "ctrl+shift+m",
+  [command.screen_local]: "x",
+  [command.screen_host]: "z",
+  [command.screen_alert]: "a",
+  [command.screen_confirm]: "c",
+  [command.screen_prompt]: "p",
+  [command.screen_select]: "s",
+  [command.modal_accept]: "enter,return",
+  [command.modal_close]: "escape",
 }
 
 const pick = (value: unknown, fallback: string) => {
@@ -43,16 +70,14 @@ const num = (value: unknown, fallback: number) => {
   return value
 }
 
-const rec = (value: unknown) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return
-  return Object.fromEntries(Object.entries(value))
-}
+const record = (value: unknown): value is Record<string, unknown> =>
+  !!value && typeof value === "object" && !Array.isArray(value)
 
 type Cfg = {
   label: string
   route: string
   vignette: number
-  keybinds: Record<string, unknown> | undefined
+  keybinds: SmokeBindings | undefined
 }
 
 type Route = {
@@ -74,7 +99,7 @@ const cfg = (options: Record<string, unknown> | undefined) => {
     label: pick(options?.label, "smoke"),
     route: pick(options?.route, "workspace-smoke"),
     vignette: Math.max(0, num(options?.vignette, 0.35)),
-    keybinds: rec(options?.keybinds),
+    keybinds: record(options?.keybinds) ? (options.keybinds as SmokeBindings) : undefined,
   }
 }
 
@@ -85,7 +110,12 @@ const names = (input: Cfg) => {
   }
 }
 
-type Keys = TuiKeybindSet
+function createKeys(input: SmokeBindings | undefined) {
+  return createBindingLookup({ ...defaultKeymap, ...input })
+}
+
+type Keys = ReturnType<typeof createKeys>
+
 const ui = {
   panel: "#1d1d1d",
   border: "#4a4a4a",
@@ -292,125 +322,174 @@ const Screen = (props: {
   }
   const pop = (base?: State) => {
     const next = base ?? current(props.api, props.route)
-    const local = Math.max(0, next.local - 1)
-    set(local, next)
+    set(Math.max(0, next.local - 1), next)
   }
   const show = () => {
     setTimeout(() => {
       open()
     }, 0)
   }
-  useKeyboard((evt) => {
-    if (props.api.route.current.name !== props.route.screen) return
-    const next = current(props.api, props.route)
-    if (props.api.ui.dialog.open) {
-      if (props.keys.match("dialog_close", evt)) {
-        evt.preventDefault()
-        evt.stopPropagation()
-        props.api.ui.dialog.clear()
-        return
-      }
-      return
-    }
+  const screenActive = () => props.api.route.current.name === props.route.screen
 
-    if (next.local > 0) {
-      if (evt.name === "escape" || props.keys.match("local_close", evt)) {
-        evt.preventDefault()
-        evt.stopPropagation()
-        pop(next)
-        return
-      }
+  useBindings(() => ({
+    enabled: () => screenActive() && props.api.ui.dialog.open,
+    commands: [
+      {
+        name: command.dialog_close,
+        run() {
+          props.api.ui.dialog.clear()
+        },
+      },
+    ],
+    bindings: props.keys.gather("smoke.dialog", [command.dialog_close]),
+  }))
 
-      if (props.keys.match("local_push", evt)) {
-        evt.preventDefault()
-        evt.stopPropagation()
-        push(next)
-        return
-      }
-      return
-    }
+  useBindings(() => ({
+    enabled: () => screenActive() && !props.api.ui.dialog.open && current(props.api, props.route).local > 0,
+    commands: [
+      {
+        name: command.local_push,
+        run() {
+          push(current(props.api, props.route))
+        },
+      },
+      {
+        name: command.local_pop,
+        run() {
+          pop(current(props.api, props.route))
+        },
+      },
+    ],
+    bindings: props.keys.gather("smoke.local", [command.local_push, command.local_pop]),
+  }))
 
-    if (props.keys.match("home", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate("home")
-      return
-    }
+  useBindings(() => ({
+    enabled: () => screenActive() && !props.api.ui.dialog.open && current(props.api, props.route).local === 0,
+    commands: [
+      {
+        name: command.screen_home,
+        run() {
+          props.api.route.navigate("home")
+        },
+      },
+      {
+        name: command.screen_left,
+        run() {
+          const next = current(props.api, props.route)
+          props.api.route.navigate(props.route.screen, { ...next, tab: (next.tab - 1 + tabs.length) % tabs.length })
+        },
+      },
+      {
+        name: command.screen_right,
+        run() {
+          const next = current(props.api, props.route)
+          props.api.route.navigate(props.route.screen, { ...next, tab: (next.tab + 1) % tabs.length })
+        },
+      },
+      {
+        name: command.screen_up,
+        run() {
+          const next = current(props.api, props.route)
+          props.api.route.navigate(props.route.screen, { ...next, count: next.count + 1 })
+        },
+      },
+      {
+        name: command.screen_down,
+        run() {
+          const next = current(props.api, props.route)
+          props.api.route.navigate(props.route.screen, { ...next, count: next.count - 1 })
+        },
+      },
+      {
+        name: command.screen_modal,
+        run() {
+          props.api.route.navigate(props.route.modal, current(props.api, props.route))
+        },
+      },
+      {
+        name: command.screen_local,
+        run() {
+          open()
+        },
+      },
+      {
+        name: command.screen_host,
+        run() {
+          host(props.api, props.input, skin)
+        },
+      },
+      {
+        name: command.screen_alert,
+        run() {
+          warn(props.api, props.route, current(props.api, props.route))
+        },
+      },
+      {
+        name: command.screen_confirm,
+        run() {
+          check(props.api, props.route, current(props.api, props.route))
+        },
+      },
+      {
+        name: command.screen_prompt,
+        run() {
+          entry(props.api, props.route, current(props.api, props.route))
+        },
+      },
+      {
+        name: command.screen_select,
+        run() {
+          picker(props.api, props.route, current(props.api, props.route))
+        },
+      },
+    ],
+    bindings: props.keys.gather("smoke.screen", [
+      command.screen_home,
+      command.screen_left,
+      command.screen_right,
+      command.screen_up,
+      command.screen_down,
+      command.screen_modal,
+      command.screen_local,
+      command.screen_host,
+      command.screen_alert,
+      command.screen_confirm,
+      command.screen_prompt,
+      command.screen_select,
+    ]),
+  }))
+  const shortcuts = useKeymapSelector((keymap) => {
+    const bindings = keymap.getCommandBindings({
+      visibility: "registered",
+      commands: [
+        command.screen_home,
+        command.screen_up,
+        command.screen_down,
+        command.screen_modal,
+        command.screen_alert,
+        command.screen_confirm,
+        command.screen_prompt,
+        command.screen_select,
+        command.screen_local,
+        command.screen_host,
+        command.local_push,
+        command.local_pop,
+      ],
+    })
 
-    if (props.keys.match("left", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate(props.route.screen, { ...next, tab: (next.tab - 1 + tabs.length) % tabs.length })
-      return
-    }
-
-    if (props.keys.match("right", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate(props.route.screen, { ...next, tab: (next.tab + 1) % tabs.length })
-      return
-    }
-
-    if (props.keys.match("up", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate(props.route.screen, { ...next, count: next.count + 1 })
-      return
-    }
-
-    if (props.keys.match("down", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate(props.route.screen, { ...next, count: next.count - 1 })
-      return
-    }
-
-    if (props.keys.match("modal", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate(props.route.modal, next)
-      return
-    }
-
-    if (props.keys.match("local", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      open()
-      return
-    }
-
-    if (props.keys.match("host", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      host(props.api, props.input, skin)
-      return
-    }
-
-    if (props.keys.match("alert", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      warn(props.api, props.route, next)
-      return
-    }
-
-    if (props.keys.match("confirm", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      check(props.api, props.route, next)
-      return
-    }
-
-    if (props.keys.match("prompt", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      entry(props.api, props.route, next)
-      return
-    }
-
-    if (props.keys.match("select", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      picker(props.api, props.route, next)
+    return {
+      screen_home: props.api.keys.formatBindings(bindings.get(command.screen_home)) ?? "",
+      screen_up: props.api.keys.formatBindings(bindings.get(command.screen_up)) ?? "",
+      screen_down: props.api.keys.formatBindings(bindings.get(command.screen_down)) ?? "",
+      screen_modal: props.api.keys.formatBindings(bindings.get(command.screen_modal)) ?? "",
+      screen_alert: props.api.keys.formatBindings(bindings.get(command.screen_alert)) ?? "",
+      screen_confirm: props.api.keys.formatBindings(bindings.get(command.screen_confirm)) ?? "",
+      screen_prompt: props.api.keys.formatBindings(bindings.get(command.screen_prompt)) ?? "",
+      screen_select: props.api.keys.formatBindings(bindings.get(command.screen_select)) ?? "",
+      screen_local: props.api.keys.formatBindings(bindings.get(command.screen_local)) ?? "",
+      screen_host: props.api.keys.formatBindings(bindings.get(command.screen_host)) ?? "",
+      local_push: props.api.keys.formatBindings(bindings.get(command.local_push)) ?? "",
+      local_pop: props.api.keys.formatBindings(bindings.get(command.local_pop)) ?? "",
     }
   })
 
@@ -430,7 +509,7 @@ const Screen = (props: {
             <b>{props.input.label} screen</b>
             <span style={{ fg: skin.muted }}> plugin route</span>
           </text>
-          <text fg={skin.muted}>{props.keys.print("home")} home</text>
+          <text fg={skin.muted}>{shortcuts().screen_home} home</text>
         </box>
 
         <box flexDirection="row" gap={1} paddingBottom={1}>
@@ -477,7 +556,7 @@ const Screen = (props: {
             <box flexDirection="column" gap={1}>
               <text fg={skin.text}>Counter: {value.count}</text>
               <text fg={skin.muted}>
-                {props.keys.print("up")} / {props.keys.print("down")} change value
+                {shortcuts().screen_up} / {shortcuts().screen_down} change value
               </text>
             </box>
           ) : null}
@@ -485,17 +564,16 @@ const Screen = (props: {
           {value.tab === 2 ? (
             <box flexDirection="column" gap={1}>
               <text fg={skin.muted}>
-                {props.keys.print("modal")} modal | {props.keys.print("alert")} alert | {props.keys.print("confirm")}{" "}
-                confirm | {props.keys.print("prompt")} prompt | {props.keys.print("select")} select
+                {shortcuts().screen_modal} modal | {shortcuts().screen_alert} alert | {shortcuts().screen_confirm}{" "}
+                confirm | {shortcuts().screen_prompt} prompt | {shortcuts().screen_select} select
               </text>
               <text fg={skin.muted}>
-                {props.keys.print("local")} local stack | {props.keys.print("host")} host stack
+                {shortcuts().screen_local} local stack | {shortcuts().screen_host} host stack
               </text>
               <text fg={skin.muted}>
-                local open: {props.keys.print("local_push")} push nested · esc or {props.keys.print("local_close")}{" "}
-                close
+                local open: {shortcuts().local_push} push nested · {shortcuts().local_pop} close
               </text>
-              <text fg={skin.muted}>{props.keys.print("home")} returns home</text>
+              <text fg={skin.muted}>{shortcuts().screen_home} returns home</text>
             </box>
           ) : null}
         </box>
@@ -548,7 +626,7 @@ const Screen = (props: {
           </text>
           <text fg={skin.muted}>Plugin-owned stack depth: {value.local}</text>
           <text fg={skin.muted}>
-            {props.keys.print("local_push")} push nested · {props.keys.print("local_close")} pop/close
+            {shortcuts().local_push} push nested · {shortcuts().local_pop} pop/close
           </text>
           <box flexDirection="row" gap={1}>
             <Btn txt="push" run={push} skin={skin} on />
@@ -571,20 +649,35 @@ const Modal = (props: {
   const value = parse(props.params)
   const skin = tone(props.api)
 
-  useKeyboard((evt) => {
-    if (props.api.route.current.name !== props.route.modal) return
+  useBindings(() => ({
+    enabled: () => props.api.route.current.name === props.route.modal,
+    commands: [
+      {
+        name: command.modal_accept,
+        run() {
+          props.api.route.navigate(props.route.screen, { ...parse(props.params), source: "modal" })
+        },
+      },
+      {
+        name: command.modal_close,
+        run() {
+          props.api.route.navigate("home")
+        },
+      },
+    ],
+    bindings: props.keys.gather("smoke.modal", [command.modal_accept, command.modal_close]),
+  }))
+  const shortcuts = useKeymapSelector((keymap) => {
+    const bindings = keymap.getCommandBindings({
+      visibility: "registered",
+      commands: [command.modal, command.screen, command.modal_accept, command.modal_close],
+    })
 
-    if (props.keys.match("modal_accept", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate(props.route.screen, { ...value, source: "modal" })
-      return
-    }
-
-    if (props.keys.match("modal_close", evt)) {
-      evt.preventDefault()
-      evt.stopPropagation()
-      props.api.route.navigate("home")
+    return {
+      modal: props.api.keys.formatBindings(bindings.get(command.modal)) ?? "",
+      screen: props.api.keys.formatBindings(bindings.get(command.screen)) ?? "",
+      modal_accept: props.api.keys.formatBindings(bindings.get(command.modal_accept)) ?? "",
+      modal_close: props.api.keys.formatBindings(bindings.get(command.modal_close)) ?? "",
     }
   })
 
@@ -595,10 +688,10 @@ const Modal = (props: {
           <text fg={skin.text}>
             <b>{props.input.label} modal</b>
           </text>
-          <text fg={skin.muted}>{props.keys.print("modal")} modal command</text>
-          <text fg={skin.muted}>{props.keys.print("screen")} screen command</text>
+          <text fg={skin.muted}>{shortcuts().modal} modal command</text>
+          <text fg={skin.muted}>{shortcuts().screen} screen command</text>
           <text fg={skin.muted}>
-            {props.keys.print("modal_accept")} opens screen · {props.keys.print("modal_close")} closes
+            {shortcuts().modal_accept} opens screen · {shortcuts().modal_close} closes
           </text>
           <box flexDirection="row" gap={1}>
             <Btn
@@ -651,25 +744,8 @@ const home = (api: TuiPluginApi, input: Cfg) => ({
     },
     home_prompt(ctx, value) {
       const skin = look(ctx.theme.current)
-      type Prompt = (props: {
-        workspaceID?: string
-        visible?: boolean
-        disabled?: boolean
-        onSubmit?: () => void
-        hint?: JSX.Element
-        right?: JSX.Element
-        showPlaceholder?: boolean
-        placeholders?: {
-          normal?: string[]
-          shell?: string[]
-        }
-      }) => JSX.Element
-      type Slot = (
-        props: { name: string; mode?: unknown; children?: JSX.Element } & Record<string, unknown>,
-      ) => JSX.Element | null
-      const ui = api.ui as TuiPluginApi["ui"] & { Prompt: Prompt; Slot: Slot }
-      const Prompt = ui.Prompt
-      const Slot = ui.Slot
+      const Prompt = api.ui.Prompt
+      const Slot = api.ui.Slot
       const normal = [
         `[SMOKE] route check for ${input.label}`,
         "[SMOKE] confirm home_prompt slot override",
@@ -791,109 +867,115 @@ const slot = (api: TuiPluginApi, input: Cfg): TuiSlotPlugin[] => [
 
 const reg = (api: TuiPluginApi, input: Cfg, keys: Keys) => {
   const route = names(input)
-  api.command.register(() => [
-    {
-      title: `${input.label} modal`,
-      value: "plugin.smoke.modal",
-      keybind: keys.get("modal"),
-      category: "Plugin",
-      slash: {
-        name: "smoke",
+  api.keymap.registerLayer({
+    commands: [
+      {
+        name: command.modal,
+        title: `${input.label} modal`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke",
+        run() {
+          api.route.navigate(route.modal, { source: "command" })
+        },
       },
-      onSelect: () => {
-        api.route.navigate(route.modal, { source: "command" })
+      {
+        name: command.screen,
+        title: `${input.label} screen`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke-screen",
+        run() {
+          api.route.navigate(route.screen, { source: "command", tab: 0, count: 0 })
+        },
       },
-    },
-    {
-      title: `${input.label} screen`,
-      value: "plugin.smoke.screen",
-      keybind: keys.get("screen"),
-      category: "Plugin",
-      slash: {
-        name: "smoke-screen",
+      {
+        name: command.alert,
+        title: `${input.label} alert dialog`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke-alert",
+        run() {
+          warn(api, route, current(api, route))
+        },
       },
-      onSelect: () => {
-        api.route.navigate(route.screen, { source: "command", tab: 0, count: 0 })
+      {
+        name: command.confirm,
+        title: `${input.label} confirm dialog`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke-confirm",
+        run() {
+          check(api, route, current(api, route))
+        },
       },
-    },
-    {
-      title: `${input.label} alert dialog`,
-      value: "plugin.smoke.alert",
-      category: "Plugin",
-      slash: {
-        name: "smoke-alert",
+      {
+        name: command.prompt,
+        title: `${input.label} prompt dialog`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke-prompt",
+        run() {
+          entry(api, route, current(api, route))
+        },
       },
-      onSelect: () => {
-        warn(api, route, current(api, route))
+      {
+        name: command.select,
+        title: `${input.label} select dialog`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke-select",
+        run() {
+          picker(api, route, current(api, route))
+        },
       },
-    },
-    {
-      title: `${input.label} confirm dialog`,
-      value: "plugin.smoke.confirm",
-      category: "Plugin",
-      slash: {
-        name: "smoke-confirm",
+      {
+        name: command.host,
+        title: `${input.label} host overlay`,
+        category: "Plugin",
+        namespace: "palette",
+        slashName: "smoke-host",
+        run() {
+          host(api, input, tone(api))
+        },
       },
-      onSelect: () => {
-        check(api, route, current(api, route))
+      {
+        name: command.home,
+        title: `${input.label} go home`,
+        category: "Plugin",
+        namespace: "palette",
+        enabled: () => api.route.current.name !== "home",
+        run() {
+          api.route.navigate("home")
+        },
       },
-    },
-    {
-      title: `${input.label} prompt dialog`,
-      value: "plugin.smoke.prompt",
-      category: "Plugin",
-      slash: {
-        name: "smoke-prompt",
+      {
+        name: command.toast,
+        title: `${input.label} toast`,
+        category: "Plugin",
+        namespace: "palette",
+        run() {
+          api.ui.toast({
+            variant: "info",
+            title: "Smoke",
+            message: "Plugin toast works",
+            duration: 2000,
+          })
+        },
       },
-      onSelect: () => {
-        entry(api, route, current(api, route))
-      },
-    },
-    {
-      title: `${input.label} select dialog`,
-      value: "plugin.smoke.select",
-      category: "Plugin",
-      slash: {
-        name: "smoke-select",
-      },
-      onSelect: () => {
-        picker(api, route, current(api, route))
-      },
-    },
-    {
-      title: `${input.label} host overlay`,
-      value: "plugin.smoke.host",
-      category: "Plugin",
-      slash: {
-        name: "smoke-host",
-      },
-      onSelect: () => {
-        host(api, input, tone(api))
-      },
-    },
-    {
-      title: `${input.label} go home`,
-      value: "plugin.smoke.home",
-      category: "Plugin",
-      enabled: api.route.current.name !== "home",
-      onSelect: () => {
-        api.route.navigate("home")
-      },
-    },
-    {
-      title: `${input.label} toast`,
-      value: "plugin.smoke.toast",
-      category: "Plugin",
-      onSelect: () => {
-        api.ui.toast({
-          variant: "info",
-          title: "Smoke",
-          message: "Plugin toast works",
-          duration: 2000,
-        })
-      },
-    },
-  ])
+    ],
+    bindings: keys.gather("smoke.global", [
+      command.modal,
+      command.screen,
+      command.alert,
+      command.confirm,
+      command.prompt,
+      command.select,
+      command.host,
+      command.home,
+      command.toast,
+    ]),
+  })
 }
 
 const tui: TuiPlugin = async (api, options, meta) => {
@@ -902,9 +984,9 @@ const tui: TuiPlugin = async (api, options, meta) => {
   await api.theme.install("./smoke-theme.json")
   api.theme.set("smoke-theme")
 
-  const value = cfg(options ?? undefined)
+  const value = cfg(options)
   const route = names(value)
-  const keys = api.keybind.create(bind, value.keybinds)
+  const keys = createKeys(value.keybinds)
   const fx = new VignetteEffect(value.vignette)
   const post = fx.apply.bind(fx)
   api.renderer.addPostProcessFn(post)

.opencode/skills/effect/SKILL.md

@@ -1,21 +1,38 @@
 ---
 name: effect
-description: Answer questions about the Effect framework
+description: Work with Effect v4 / effect-smol TypeScript code in this repo
 ---
 
 # Effect
 
-This codebase uses Effect, a framework for writing typescript.
+This codebase uses Effect for typed, composable TypeScript services, schemas, and workflows.
 
-## How to Answer Effect Questions
+## Source Of Truth
 
-1. Clone the Effect repository: `https://github.com/Effect-TS/effect-smol` to
-   `.opencode/references/effect-smol` in this project NOT the skill folder.
-2. Use the explore agent to search the codebase for answers about Effect patterns, APIs, and concepts
-3. Provide responses based on the actual Effect source code and documentation
+Use the current Effect v4 / effect-smol source, not memory or older Effect v2/v3 examples.
+
+1. If `.opencode/references/effect-smol` is missing, clone `https://github.com/Effect-TS/effect-smol` there. Do this in the project, not in the skill folder.
+2. Search `.opencode/references/effect-smol` for exact APIs, examples, tests, and naming patterns before answering or implementing Effect-specific code.
+3. Also inspect existing repo code for local house style before introducing new patterns.
+4. Prefer answers and implementations backed by specific source files or nearby repo examples.
 
 ## Guidelines
 
-- Always use the explore agent with the cloned repository when answering Effect-related questions
-- Reference specific files and patterns found in the Effect codebase
-- Do not answer from memory - always verify against the source
+- Prefer current Effect v4 APIs and project-local patterns over old blog posts, examples, or package-memory guesses.
+- Use `Effect.gen(function* () { ... })` for multi-step workflows.
+- Use `Effect.fn("Name")` or `Effect.fnUntraced(...)` for named effects when adding reusable service methods or important workflows.
+- Prefer Effect `Schema` for API and domain data shapes. Use branded schemas for IDs and `Schema.TaggedErrorClass` for typed domain errors when modeling new error surfaces.
+- Keep HTTP handlers thin: decode input, read request context, call services, and map transport errors. Put business rules in services.
+- In Effect service code, prefer Effect-aware platform abstractions and dependencies over ad hoc promises where the surrounding code already does so.
+- Keep layer composition explicit. Avoid broad hidden provisioning that makes missing dependencies hard to see.
+- In tests, prefer the repo's existing Effect test helpers and live tests for filesystem, git, child process, locks, or timing behavior.
+- Do not introduce `any`, non-null assertions, unchecked casts, or older Effect APIs just to satisfy types.
+- Do not answer from memory. Verify against `.opencode/references/effect-smol` or nearby code first.
+
+## Testing Patterns
+
+- Use `testEffect(...)` from `packages/opencode/test/lib/effect.ts` for tests that exercise Effect services, layers, runtime context, scoped resources, or platform integrations.
+- Use `it.live(...)` for filesystem, git repositories, HTTP servers, sockets, child processes, locks, real time, and other live platform behavior.
+- Run tests from package directories such as `packages/opencode`; never run package tests from the repo root.
+- Prefer explicit test layers over ad hoc managed runtimes. Keep dependency provisioning visible in the test file.
+- Use scoped fixtures and finalizers for resources that must be cleaned up, including temporary directories, flags, databases, fibers, servers, and global state.