[marius-kilocode]

Merge with 'Create a merge commit'. Do not squash or rebase.

Closes #15422

Release

Item	Value
Included releases	v2.1.2 (tag a517687fde9, release commit c600cddc68f, 2026-10-21) and v2.1.3 (tag bb25a2f4a3f, release commit 37d973754ba, 2026-10-22)
Release commit (merged)	37d973754ba, parent of the v2.1.3 tag, on upstream/dev
Upstream range	e9ac459c2e6..37d973754ba (v2.1.1 to v2.1.3): 96 commits, 396 files, harness change 200 files +5063/-1455. v2.1.2 part: 31 commits, 161 files
Sync merge	0d8ae9be328 chore(upstream): sync v2.1.3 (37d973754ba). pinned() resolves v2.1.3 / 37d973754ba
Lag before	3 releases (v2.1.2, v2.1.3, v2.1.4), 2.9 days
Lag after	1 release (v2.1.4, 74f8d4860f4, released 2026-10-23 during this work), 0.9 days

Why one PR for two releases: v2.1.2 and v2.1.3 overlap with Kilo-changed files in only 10 modified files (lock file, 4 package.json files, 4 core files, 1 TUI file), and one sync PR keeps the Bun bump and the lock regeneration in one place. The merge used --allow-skip.

Commits in this PR:

1. 0d8ae9be328 the sync merge (script/upstream/merge.ts --version v2.1.3 --base-branch HEAD --allow-skip).
2. 021d6b31848 merge of origin/v2 (feat(tui): order the model picker by Kilo Gateway metadata #15405 landed during verification). Clean merge.
3. 80b53bc9b5d docs(migration): baseline for v2.1.3.
4. d75e69380b1 merge of origin/v2 (docs(migration): record branch-name generation findings #15345, feat(tui): show Kilo Gateway news on the home screen #15407 landed during verification). Clean merge.
5. 5c251c17ec4 docs(migration): update v2.1.3 baseline after merging v2.

Upstream content (relevant to Kilo): packageManager bun 1.4.2 to 1.4.4 (anomalyco/opencode#58087, expected to fix the Windows Bun module loader segfault in packages/util); typed free-limit session error (provider.free-limit) with a TUI notice, prompt recall and OpenCode Go upsell modal; OPENCODE_DISABLE_FREE_MODELS; configured provider baseURL overrides catalog model endpoints; compaction summaries get the normal output limit; titles at the lowest model variant; Windows service port moved out of the WSL mirrored range; many core and ai type and schema cleanups; @pierre/diffs 1.6.1 and @pierre/highlights replace shiki in the web UI packages (removed on Kilo).

Conflicts

File	Kind	Resolution
packages/core/src/session/runner/publish-llm-event.ts	content	Kept the 4 kilocode_change(gateway) lines (KiloSessionUsage import, providerCost field, native and providerCost in the step settlement) on top of upstream's changes (TokenUsage.Info, SessionMessage.Native, shared isRecord and stringify). Resolved by the tooling (mergiraf); verified by hand and by bun run check. Rung unchanged (4, gateway cost), no Kilo code moved
bun.lock	content	Kept ours, regenerated with bun 1.4.4. Delta vs origin/v2: upstream dependency bumps only (@types/bun 1.4.3, bun-types 1.4.4, @opentunnel/* 0.4.1, @pierre/diffs 1.6.1, @pierre/highlights, shiki removed)
.github/workflows/pr-management.yml, publish.yml	modify/delete	Kept deleted (check-workflows.ts --fix)
118 files in infra/, packages/{app,console,desktop,function,gui-extensions,session-ui,stats,storybook,web}/, salesforce/, sdks/vscode/	modify/delete	Kept deleted (product areas Kilo removed)

No new upstream workflows. Upstream deleted duplicate-issues.yml, opencode.yml, review.yml (already deleted on Kilo) and script/duplicate-pr.ts (not Kilo-owned, deletion taken). script/check-workflows.ts needs no change (3 active workflows).

Shared files touched

Upstream changed these Kilo-patched shared files. Kilo's added and removed lines in each file are identical before and after the sync:

• package.json, packages/{cli,core,tui}/package.json: version and dependency bumps (rung 3 entries, unchanged).
• packages/core/src/session/runner/publish-llm-event.ts: conflict above (rung 4).
• packages/core/src/plugin/internal.ts, packages/core/src/session/compaction.ts, packages/core/src/session/title.ts, packages/tui/src/routes/session/index.tsx: clean merge, Kilo lines unchanged.

check-shared-patches: 43 files, 318 marked, 39 unmarked at the sync merge (the origin/v2 limits of that time); 46 files, 334 marked, 39 unmarked at the head after the two origin/v2 merges. All at their limits. The sync adds or removes no patch, so no limit changes.

Kilo-diff check

• git diff --no-renames --name-status e9ac459c2e6 origin/v2 vs ... 37d973754ba HEAD (head d75e69380b1, origin/v2 aa7d29226e4): identical except for files upstream deleted or added inside Kilo-removed areas (3 workflows, .opencode/agent/duplicate-pr.md, 18 deleted packages/console files, 8 new upstream files in packages/{app,console,session-ui,stats} that stay absent).
• Per-file added and removed lines: identical for all 367 non-deleted files except bun.lock (regenerated) and pinned-v2-baseline.md (baseline refresh). Both intended.
• git diff --stat origin/v2 HEAD -- 'packages/kilo-*' 'packages/*/src/kilocode' 'packages/*/test/kilocode' .github .kilo script migration-tracking: only pinned-v2-baseline.md and upstream's deletion of script/duplicate-pr.ts.
• Merged Kilo work is intact: Gateway accounts, enterprise policy, models, costs, errors, OpenCode free-tier filter, Kilo-first integrations, per-session feature header, custom-server defaults, /usage, model picker (feat(tui): order the model picker by Kilo Gateway metadata #15405), Kilo news (feat(tui): show Kilo Gateway news on the home screen #15407). bun dev models --standalone: the kilo/ list (16 models) is identical on this branch and on origin/v2.
• git merge-tree against the open v2 PRs: chore(ci): add macOS platform test job #15424, chore(ci): run the non-sharded unit tests in a parallel leg #15415, docs(review): focus Kilo PR reviews on migration gaps #15414, fix: match v1 OpenAI sign-in and identify as Kilo #15411, docs(migration): list v1 to v2 client breaking changes #15291, docs(migration): drop the v1 fixtures and session-policy units #15286 merge cleanly. fix(kilo-cli): apply Kilo functional branding #15417, docs(migration): record the client, identity and sync-gate decisions of 2026-10-20 #15290 have the same conflicts as against origin/v2. feat(vscode): reuse the v1 extension on the v2 server #15370 and feat(vscode): reuse the v1 extension UI on v2 data #15349 get one new conflict, bun.lock (regenerate it).

Checks

All runs used bun 1.4.4 (packageManager), after bun install --linker hoisted --frozen-lockfile.

Check	Result
bun run check (root)	pass, 28/28 tasks, oxlint 209 warnings, 0 errors
check-workflows, check-opencode-annotations (72 shared files vs 37d973754ba), check-shared-patches	pass
find-reset-candidates --dry-run	0 candidates (only removed workflows listed as missing)
packages/protocol, packages/client check:generated; packages/client bun run generate	pass, no drift
progress.ts twice + --check	identical output, up to date. 143/9828, the same as origin/v2: the sync does not change the map
v2-baseline.ts --checks (CI mirror, clean detached worktree outside the repo)	all pass except test (13 known host failures) and lint:effect-patterns (27 errors, unchanged, not run by CI)

Tests and baseline delta

bun turbo test --force with isolated OPENCODE_TEST_HOME and XDG_*, same script on both sides (origin/v2 2af82eef6a8 with bun 1.4.2):

Package	Sync branch	origin/v2
core	6,732 pass, 13 fail	6,693 pass, 13 fail (same 13)
cli	339 pass	339 pass
server	87 pass	87 pass
tui	1,601 pass	1,596 pass
plugin	9 pass	9 pass
kilo-gateway-core	104 pass	104 pass
kilo-plugin	188 pass	188 pass
kilo-cli	62 pass	62 pass

After the second origin/v2 merge: tui 1,604, plugin 9, kilo-plugin 188, kilo-cli 62 pass.

New failures: none. The 13 core failures are host-specific and identical on origin/v2: 7 shell cases (macOS bash 3.2) and 6 Session.shell cases (fish login shell; with SHELL=/bin/zsh the file passes 9/9). pinned-v2-baseline.md now has a v2.1.3 capture; the v2.1.1 capture moves to previous captures. No test was skipped or edited.

Self-test

Fresh KILO_V2_PROFILE for each run, signed out, bun 1.4.4:

• bun dev run --standalone --model kilo/kilo-auto/free "Reply with only the word ok.": answered ok, no level=ERROR log lines. Pass.
• TUI in the VS Code terminal harness (--mode none): the home screen shows Auto Free · Kilo Gateway; the model picker lists the Kilo Gateway models with the info panel; /connect lists Kilo Gateway first under Popular; the prompt "What is VERSION in math.ts?" answered 1.2.3 through Auto Free; logs is empty. Pass.
• bun dev models --standalone: the kilo/ list is identical to origin/v2.

Upstream impact

• Bun 1.4.4 for open PRs: after this merges, open v2 PRs must merge v2 and use bun 1.4.4 (packageManager). Another Bun version rewrites bun.lock, and the pre-push hook rejects it.
• The new provider.free-limit error and the OpenCode Go upsell modal trigger only on a QuotaExceeded error whose body contains FreeUsageLimitError (an OpenCode Console error name). Kilo Gateway errors are not expected to match; not verified against a real free-limit response.
• OPENCODE_DISABLE_FREE_MODELS is a new upstream knob; Kilo does not set it.

Tooling gaps

• merge.ts stops on v2.1.3 skips v2.1.2 without --allow-skip. This is intended; the flag was passed after the decision to include both releases.
• merge.ts --base-branch HEAD commits the merge and prints "Open a PR from sync-v2-1-3 into sync-v2-1-3". With an in-place merge, it should name v2. Cosmetic, also seen in the v2.1.1 sync.
• origin/v2 moved twice during verification. Each time progress.ts --check turned stale (the history reads origin/v2) and the Kilo-diff check showed the new Kilo work as a diff. The fix both times was a normal merge of origin/v2.
• The reference worktrees under .worktrees/upstream-sync/ and the upstream-sync-auto-v2.1.3 branch stay after the run; they were removed by hand.
• No manual merge steps were needed.

Follow-ups

• Next sync: v2.1.4 (74f8d4860f4).

[github-actions]

➖ v2 migration progress: 1.5% → 1.5% (0 done, 0 total, 0 dropped; 143/9828 cells)

Placement: 0 new marked lines in shared files, 0 new kilo_port annotations, 0 new core-internal imports.

Ratchets: 25 core-internal imports (base 25); shared patches by rung 26 seam, 20 patch (base 26 seam, 20 patch).

No change to the progress map.

Full map · how cells close

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​bun@​1.4.0 ⏵ 1.4.3				-2
	npm/​@​opentunnel/​client@​0.4.0 ⏵ 0.4.1	+1		+1	+1
	npm/​@​pierre/​highlights@​0.2.0
	npm/​@​pierre/​diffs@​1.5.1 ⏵ 1.6.1			+1

View full report

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This is an upstream sync PR (sync-v2-1-3, includes v2.1.2 + v2.1.3, upstream range e9ac459c2e6..37d973754ba). Kilo's patch set before (e9ac459c2e6..origin/v2) and after (37d973754ba..HEAD) matches: identical file lists for every path outside product areas Kilo removed, and identical per-file insertion/deletion counts. The only differences are intended ones: bun.lock (regenerated) and pinned-v2-baseline.md (baseline refresh); the rest are upstream additions/deletions inside Kilo-removed packages (app, console, desktop, function, session-ui, stats, storybook, web, infra, salesforce) and the three upstream-deleted workflows.

The packages/core/src/session/runner/publish-llm-event.ts conflict resolution keeps all four kilocode_change(gateway) lines (import, providerCost field, native and providerCost in the step settlement), and the other shared Kilo patches (package.json, packages/{cli,core,tui}/package.json, plugin/internal.ts, session/compaction.ts, session/title.ts, tui/src/routes/session/index.tsx) are identical in their added/removed lines. Kilo-owned paths (packages/kilo-*, **/src/kilocode) are unchanged versus origin/v2.

Upstream impact: reviewed the upstream delta on the seams Kilo uses and found no break:

• Plugin API (packages/plugin/src, packages/core/src/plugin*): the mutable() removal in packages/core/src/plugin/host.ts:40 is a type-only cast (value as DeepMutable<T>), so Kilo's Ceiling and agent transforms behave the same. Agent.select/Editor.list type changes are internal; no Kilo caller passes removed shapes.
• Session hooks: SessionModelRequest.baseURL is still string | undefined, so the Gateway's model.request override is unaffected. The outputLimit(kind), interrupt({ reason, awaitSettlement }) and inbox/ID.make changes have no callers in Kilo code (no matches in packages/kilo-* or **/src/kilocode); SessionError.retryAfterMs is additive and the error type remains a plain string.
• Gateway isolation: OPENCODE_DISABLE_FREE_MODELS and the new free-model filter touch only opencode/opencode-go; the kilo model list still comes from the Gateway. The provider baseURL override in packages/core/src/config/plugin/provider.ts drops per-model baseURL only when a provider baseURL is configured; Kilo sets the same value at both levels and its model.request hook sets the final baseURL, so routing is unchanged.
• CI/workflows: check.yml, test.yml and kilo-v2.yml are unchanged, only those three exist in .github/workflows, and upstream-deleted workflows stay deleted. No .changeset files; script/upstream/shared-patches.json limits unchanged.

CI run status was not inspected during this review; the checks reported in the PR body (bun 1.4.4, 28/28 tasks, 13 pre-existing host-only core test failures identical on origin/v2) are consistent with the code inspected.

Files Reviewed (grouped; the sync touches 400+ files)

• packages/kilo-*, **/src/kilocode (Kilo-owned paths) - no changes vs origin/v2
• packages/core/src/plugin*, packages/plugin/src (plugin API seams)
• packages/core/src/session* (context, compaction, title, inbox, history, info, projector, run-coordinator, execution, model-request, publish-llm-event, to-session-error)
• packages/core/src/{model,provider,agent,permission*,config*,location-activity,worktree,project,database*}.ts
• packages/schema/src/{config/*,session-error,session-event}.ts
• packages/tui/src/** (session route conflict, storage/config watchers, model-preference, plugin watch, go-upsell)
• packages/cli/src/services/service-config.ts, packages/server/src/handlers/voice.ts
• packages/client, packages/protocol generated output (generated-file checks are CI's)
• .github/workflows, bunfig.toml, package.json files, bun.lock
• migration-tracking/technical-notes/baseline/pinned-v2-baseline.md

---

_{Reviewed by deepseek-flash-latest · Input: 98.7K · Output: 31.7K · Cached: 3.5M}

_{Review guidance: REVIEW.md from base branch v2}

[WebReflection]

AI counter-validation is green 👍