Repository navigation
feat(core): add Kilo agents - #14999
Conversation
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| item.system = PROMPT_ASK | ||
| item.mode = "primary" | ||
| item.permissions = [ | ||
| rule("*", "*", "deny"), |
There was a problem hiding this comment.
WARNING: Ask's read-only permission set can be silently widened by config permissions.
These denies are the last entries in item.permissions, but ConfigAgentPlugin runs later (packages/core/src/plugin/internal.ts:254) and appends global and per-agent config permissions to every agent (packages/core/src/config/plugin/agent.ts:90-92 and :121-123). Permission.evaluate selects with findLast (packages/core/src/permission.ts:91), so a later config rule overrides these denies. A global permissions: [{ action: "edit", resource: "*", effect: "allow" }] therefore lets Ask edit files, and the Plan agent at line 215 has the same exposure. v1 reapplied a read-only ceiling after global rules (#12053); v2 has no seam for that here. Track or document this regression explicitly.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| item.mode = "primary" | ||
| item.permissions = [ | ||
| rule("*", "*", "deny"), | ||
| ...["read", "grep", "glob", "question", "skill", "subagent", "webfetch", "websearch"].map((action) => |
There was a problem hiding this comment.
SUGGESTION: Orchestrator's read permission drops the .env guard that the other Kilo agents keep.
item.permissions is replaced wholesale here, so Agent.Info.default's read *.env -> ask, read *.env.* -> ask, and read *.env.example -> allow rules are discarded and read * -> allow lets Orchestrator read .env files with no approval. Code/Debug inherit the guard from the native Build agent and Ask/Plan include it via the read table. Consider spreading read (or adding the .env rules) into this array for consistency.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| - Use plain-text or ASCII diagrams when they help clarify your response. The CLI cannot render Mermaid diagrams. Only provide Mermaid source when the user explicitly requests it | ||
| - You may run read-only bash commands (ls, cat, grep, git log, git diff, etc.) to gather information | ||
| - You must NOT modify files, run write commands, or execute code — you are read-only | ||
| - MCP tools are available if configured — each call requires user approval |
There was a problem hiding this comment.
SUGGESTION: This claims MCP tools are available to Ask, but Ask's rules deny them.
MCP tools assert their own action name (packages/core/src/tool/mcp.ts:52), which is not in Ask's allow list, so the rule("*", "*", "deny") at agent.ts:172 denies every MCP call. This matches the PR's own note that "Ask has no MCP access yet". The prompt should not advertise a capability the agent cannot use, since the model may keep attempting MCP tools and fail.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
The incremental commit adds a post-config Issue Details (click to expand)SUGGESTION
Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous Review Summaries (2 snapshots, latest commit a7587fe)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit a7587fe)Status: 3 Issues Found | Recommendation: Address before merge Overview
The Kilo agent set is faithfully ported: the Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous review (commit e8e2ef2)Status: 3 Issues Found | Recommendation: Address before merge Overview
The Kilo agent set is faithfully ported: the Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (6 files)
Reviewed by deepseek-v4.1-flash · Input: 126.8K · Output: 49.9K · Cached: 2.5M |
AI counter-check findings
|
e8e2ef2 to
a7587fe
Compare
| ], | ||
| orchestrator: [ | ||
| rule("*", "*", "deny"), | ||
| ...allow("read", "grep", "glob", "question", "skill", "subagent", "webfetch", "websearch"), |
There was a problem hiding this comment.
SUGGESTION: Orchestrator's read rules drop the .env guard the other Kilo agents keep.
guards() gives Orchestrator read * -> allow with no read *.env -> ask / read *.env.* -> ask rule, so replacing its permissions with structuredClone(guard.orchestrator) leaves Orchestrator able to read .env files without approval. Code/Debug inherit the guard from the native Build agent, and Ask/Plan include it via the read table. Consider spreading the read table (or adding the .env rules) here for consistency.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
What Problem This Solves
v2 ships only the upstream agents: Build, Plan, and the General and Explore subagents. Kilo v1 ships Code, Ask, Debug, Orchestrator and Plan, with Kilo prompts and permissions. Without them,
Shift+Tabshows Build and Plan only, and no read-only Ask agent exists. This is plan unit U-E2-12.Why This Change Was Made
The agents live in a Kilo-owned built-in plugin,
packages/core/src/kilocode/agent.ts, which uses the public agent editor (ctx.agent.transform). The shared changes are small and markedkilocode_change:packages/core/src/plugin/internal.ts: one import and two list entries.KiloAgentPlugin.Pluginruns inpre, after the native agent and Plan plugins.KiloAgentPlugin.Ceilingruns inpost, right afterConfigAgentPlugin.packages/server/test/fetch.test.ts: the readiness probe now waits until the config ruleshell * askis the last shell rule. Kilo's own default shell rules also contain* ask, so the old probe passed before config was applied.Behavior comes from v1 on
main(packages/opencode/src/kilocode/agent/index.ts,kilocode/session/mode-reminders.ts). v1bashandtaskrules map to v2shellandsubagent.code, as in v1. It is the default agent. The TUI shows the title-cased ID, so it shows "Code" without a TUI patchbuildbuildtocode. Upstream code, tests, commands and clients that still namebuildkeep working, and the list has no second Code entrygeneral. It keeps the native Plan directory that the native Plan reminder namesdisabledremoves it.Differences from v1
agent.ask.permissioncan allow themplan_exit, plan prompt.kilo/plans, Kilo plan prompt and follow-up~/.opencode/planand native Plan reminderagent.buildconfig,default_agent: "build"codebuildcopydisplayNameandsource/agent-builderHTTP API, JetBrains only)User Impact
Shift+Tabcycles Code, Ask, Debug, Orchestrator, Plan. The prompt shows "Code" instead of "Build".git log."*": "allow"in config no longer makes Ask or Plan writable.Evidence
Automated (temporary XDG directories):
bun typecheckinpackages/coreandpackages/serveroxlint,prettier --check,ast-grepon changed filesbun test test/kilocode(core)KiloAgentPlugin.Ceilingdenyexpected,allowreceived), so the test covers the ceilingpinned-v2-baseline.mdbun test test/fetch.test.ts(server), 3 runsTUI self-test (skill recipe,
bun dev --standalonewith a new profile,kilo/kilo-auto/free, test repo withmath.ts):Code · Auto Free Kilo GatewayShift+Tabfive times/agentsdialogmath.tsunchangedgit log --onelinenode -e "console.log(41+1)"lsThe model refused the Ask edits on its prompt. The unit tests cover the rule-level denies (edit, subagent, unknown tools, writes and redirects in shell, global config widening).
The v2 TUI still shows the upstream logo. Branding is a separate unit.