OpenCode v1.14.46 by marius-kilocode · Pull Request #10822 · Kilo-Org/kilocode

marius-kilocode · 2026-06-02T14:14:29Z

1.14.46

Core

Improvements

Added a built-in customize-opencode skill so opencode config edits are less likely to break startup.

Bugfixes

Fixed numeric HTTP API query parameters in the generated OpenAPI spec and SDK for session and file endpoints.
Fixed boolean HTTP API query handling so SDK types and runtime validation stay aligned.
Tolerated legacy stored numeric values in sessions, diffs, and retry events instead of failing to load old data.
Fixed old sessions with negative token counts causing message loads and Desktop startup to fail.
Fixed MCP tool discovery when a server publishes broken outputSchema references.
Fixed workspace HTTP API query drift so workspace-routed endpoints expose the right query parameters in OpenAPI and the SDK.
Fixed a Plan Mode security bypass where subagents could ignore parent-agent deny rules.

1.14.45

Core

Bugfixes

Provider configs and API responses now accept models marked as active.
Read tool permission rules now match worktree-relative paths, so read allowlists and denylists apply correctly.
Workspace-routed HTTP API endpoints no longer reject valid directory and workspace query params.

TUI

Bugfixes

Startup errors now report every failed bootstrap request instead of only the first one.
Opening a session no longer crashes when the messages request fails.

Desktop

Bugfixes

Older migrated sessions with missing diff file details load again.
Older migrated sessions with missing diff patches load again.

SDK

Bugfixes

throwOnError: true now throws a real Error with the server message and preserves the response body in cause.

Extensions

Improvements

TUI plugins using the deprecated api.command API keep working while you migrate to api.keymap.

Bugfixes

Provider plugins can no longer mutate shared provider model state for the rest of the app.

1.14.44

Core

Bugfixes

Fixed upgrades failing for existing workspaces when adding the time_used field.

1.14.43

Core

Bugfixes

Keep provider and config API responses working when auth loaders add non-JSON options to providers.
Include tool image attachments in ACP updates and session replays.

Co-authored-by: Developer <[email protected]>

…ns (#26574)

…ileDiff (#26578) Co-authored-by: Developer <[email protected]>

Co-authored-by: Developer <[email protected]>

…ms (#26581) Co-authored-by: Developer <[email protected]>

Adds regression coverage for request context inheritance in promptAsync and explicit context provisioning in stream bodies.

Read permission checks now use the same worktree-relative path basis as edit/write/apply_patch, so configured patterns apply consistently.

SDK throwOnError paths now convert structured response bodies into real Error instances while preserving the original body and status in cause.

TUI bootstrap now reports all parallel fetch failures together instead of losing sibling failures after the first rejection.

Co-authored-by: Developer <[email protected]>

…acy data (#26622)

kilo-code-bot · 2026-06-02T14:24:31Z

Code Review Summary

Status: 2 Issues Found (carried forward) | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/opencode/test/server/httpapi-sync.test.ts`	125	Test disabled with `.todo` without updating assertion to match new 400 error shape
`packages/opencode/src/kilocode/session-export/workspace-provider.ts`	133	`writeFileSync` in `save()` blocks the event loop on the main process — called synchronously on every `remember()` and `capture()` call

SUGGESTION

File	Line	Issue
`packages/opencode/src/cli/cmd/tui/plugin/command-shim.ts`	11	Module-level `warned` Set accumulates entries across test reloads; bounded in production

New Changes (incremental since 94fc422)

All new changes reviewed — no new issues found.

packages/opencode/src/tool/task.ts — cross-session resume guard + permission refresh: The session.parentID !== ctx.sessionID check (line 78-80) correctly blocks task hijacking. The KiloTask.merge call on resume (lines 91-99) puts session.permission first so first-seen-wins deduplication preserves existing child permissions, then appends freshly derived parent restrictions. Since evaluate uses findLast, a later deny override from the parent will still win against an older allow in the child — this is correct and the test at line 251-259 confirms stable deduplication across multiple resumes.

packages/opencode/src/kilocode/tool/task.ts — KiloTask.merge: Clean first-seen-wins dedup keyed on permission\0pattern\0action. Works as expected with the evaluate last-wins evaluator.

packages/opencode/src/kilocode/session/prompt.ts — mergeToolPermissions: Correctly replaces per-permission-name toggles (drops old entries with same .permission name, appends the new toggle), preserving unrelated existing rules. This is intentionally different from KiloTask.merge (which keys on permission+pattern+action) — it replaces by permission name so a user toggle always wins over a stale rule for the same tool. Well-tested.

packages/opencode/src/session/prompt.ts — mergeToolPermissions wiring: The kilocode_change block replaces the previous direct session.permission = permissions overwrite with a merge call that preserves inherited task restrictions. Correct.

Kilo HTTP API WorkspaceRoutingQuery propagation: The directory/workspace query parameters are now consistently applied to all routed Kilo-owned endpoints (agent-builder, commit-message, enhance-prompt, network, telemetry, config-console). The new test in httpapi-public.test.ts verifies all 18 routes have both params in the OpenAPI spec. SDK types in sdk.gen.ts and types.gen.ts are updated to match. The connection-service.ts any-cast workaround is cleanly removed now that the SDK types include the network methods.

packages/opencode/test/kilocode/task-nesting.test.ts — new tests: Three new cases: (1) unit test for mergeToolPermissions logic, (2) live integration test for permission refresh on resume, (3) live test for cross-session resume rejection. All well-structured and test real behavior.

Changeset — description is user-facing and appropriately concise.

Files Reviewed (incremental — changes since 94fc422)

packages/opencode/src/tool/task.ts — cross-session guard + resume permission refresh, no issues
packages/opencode/src/kilocode/tool/task.ts — KiloTask.merge added, no issues
packages/opencode/src/kilocode/session/prompt.ts — mergeToolPermissions added, no issues
packages/opencode/src/session/prompt.ts — mergeToolPermissions wiring, no issues
packages/opencode/src/kilocode/server/httpapi/groups/agent-builder.ts — WorkspaceRoutingQuery added, no issues
packages/opencode/src/kilocode/server/httpapi/groups/commit-message.ts — WorkspaceRoutingQuery added, no issues
packages/opencode/src/kilocode/server/httpapi/groups/config-console.ts — WorkspaceRoutingQuery added, no issues
packages/opencode/src/kilocode/server/httpapi/groups/enhance-prompt.ts — WorkspaceRoutingQuery added, no issues
packages/opencode/src/kilocode/server/httpapi/groups/network.ts — WorkspaceRoutingQuery added, no issues
packages/opencode/src/kilocode/server/httpapi/groups/telemetry.ts — WorkspaceRoutingQuery added, no issues
packages/opencode/test/kilocode/server/httpapi-public.test.ts — workspace routing query contract test, no issues
packages/opencode/test/kilocode/task-nesting.test.ts — 3 new tests, no issues
packages/kilo-vscode/src/services/cli-backend/connection-service.ts — any-cast removed, no issues
packages/sdk/js/src/v2/gen/sdk.gen.ts — directory/workspace params added to all relevant clients, no issues
packages/sdk/js/src/v2/gen/types.gen.ts — query types updated, no issues
packages/sdk/openapi.json — OpenAPI spec updated, no issues
.changeset/steady-worktree-routing.md — user-facing description appropriate, no issues

Fix these issues in Kilo Cloud

_{Reviewed by claude-4.6-sonnet-20260217 · 797,810 tokens}

_{Review guidance: REVIEW.md from base branch main}

…opencode-v1.14.46 # Conflicts: # packages/opencode/src/config/provider.ts

…opencode-v1.14.46 # Conflicts: # packages/opencode/src/kilocode/session/processor.ts # packages/opencode/src/server/routes/instance/httpapi/groups/session.ts # packages/opencode/src/session/processor.ts # packages/opencode/src/session/prompt.ts

…opencode-v1.14.46

marius-kilocode · 2026-06-03T18:38:02Z

Did a quick brush test on the relevant domains. Looks all good, will merge.

opencode-agent Bot and others added 30 commits May 9, 2026 16:32

chore: generate

347526e

fix(acp): include tool image attachments in updates (#25128)

817cb07

sync release versions for v1.14.42

780bbb0

ignore: fix typerrs on dev (#26544)

b1cd25d

fix(server): keep provider lists JSON-safe (#26550)

27fa297

sync release versions for v1.14.43

e221448

fix(storage): default workspace time migration (#26556)

57efec4

fix(server): return validation error bodies

ebe9dcf

fix(server): defer validation error body change

6fea017

sync release versions for v1.14.44

19abada

fix(provider): isolate plugin model mutations (#26561)

5e49029

Co-authored-by: Developer <[email protected]>

Move schema utilities into core (#26565)

dcdbdb2

Plugin command API shim (#26564)

9a8b54f

fix(tui): guard messages.data in session.sync against undefined (#26566)

6c2dfd2

Co-authored-by: Developer <[email protected]>

chore: generate

ad79f3e

fix(session): accept routing params in message list (#26569)

77da433

Co-authored-by: Developer <[email protected]>

test(session): cover workspace-routed messages (#26576)

8602937

fix(sessions): allow optional patch field in diff for migrated sessio…

d62442b

…ns (#26574)

chore: generate

480aa8b

test(session): regression test for #26574 + mirror loosening on Vcs.F…

805af01

…ileDiff (#26578) Co-authored-by: Developer <[email protected]>

chore: generate

5fa5d87

fix(session): accept legacy summary diffs (#26579)

d373c56

Co-authored-by: Developer <[email protected]>

chore: generate

c61ab51

fix(httpapi): align runtime query schemas with workspace routing para…

43b51f0

…ms (#26581) Co-authored-by: Developer <[email protected]>

test(server): cover HttpApi context inheritance

bd1029b

Adds regression coverage for request context inheritance in promptAsync and explicit context provisioning in stream bodies.

fix(tool/read): match permission patterns against worktree-relative path

ba9e4b6

Read permission checks now use the same worktree-relative path basis as edit/write/apply_patch, so configured patterns apply consistently.

fix(sdk): wrap thrown error bodies in Error

1136317

SDK throwOnError paths now convert structured response bodies into real Error instances while preserving the original body and status in cause.

fix(tui): aggregate bootstrap request failures

29b5b24

TUI bootstrap now reports all parallel fetch failures together instead of losing sibling failures after the first rejection.

chore: generate

818b56d

fix(config): allow active provider model status (#26592)

00c3248

Co-authored-by: Developer <[email protected]>

opencode and others added 15 commits May 10, 2026 00:07

sync release versions for v1.14.45

7a79f3a

Fix OpenAPI workspace query drift (#26609)

e30d817

chore: generate

6d130e5

Share HTTP API boolean query schema (#26615)

16866e1

Narrow HTTP API numeric query overrides (#26618)

6e78f36

fix(mcp): tolerate output schema ref failures (#26614)

79d6b10

feat(skill): built-in opencode-meta skill (#26617)

10ea590

chore: generate

d80e119

fix(session): tolerate negative token counts in stored parts (#26620)

c6e6bdf

fix(session): loosen remaining stored numeric schemas to tolerate leg…

29250a0

…acy data (#26622)

chore: generate

e1c1193

release: v1.14.46

d802b0a

refactor: kilo compat for v1.14.46

4472e6d

merge: record upstream v1.14.46

729a1ae

resolve merge conflicts

aeef0df

kilo-code-bot Bot reviewed Jun 2, 2026

View reviewed changes

Comment thread packages/opencode/test/server/httpapi-sync.test.ts

Comment thread packages/opencode/src/cli/cmd/tui/plugin/command-shim.ts

marius-kilocode added 6 commits June 2, 2026 18:30

Merge remote-tracking branch 'origin/main' into marius-kilocode/kilo-…

344df31

…opencode-v1.14.46 # Conflicts: # packages/opencode/src/config/provider.ts

revert(jetbrains): remove sync-only compatibility shim

1856776

Merge branch 'main' into marius-kilocode/kilo-opencode-v1.14.46

b1ade4b

Merge remote-tracking branch 'origin/main' into marius-kilocode/kilo-…

0006072

…opencode-v1.14.46

fix(jetbrains): support numeric session summaries

94fc422

imanolmzd-svg approved these changes Jun 3, 2026

View reviewed changes

fix: restore routed APIs and task restrictions

8b1ee66

marius-kilocode enabled auto-merge June 3, 2026 18:37

marius-kilocode merged commit ac02d82 into main Jun 3, 2026
23 checks passed

marius-kilocode deleted the marius-kilocode/kilo-opencode-v1.14.46 branch June 3, 2026 18:54

kilo-maintainer Bot mentioned this pull request Jun 3, 2026

release(jetbrains): v7.0.1-rc.5 #10889

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenCode v1.14.46#10822

OpenCode v1.14.46#10822
marius-kilocode merged 54 commits into
mainfrom
marius-kilocode/kilo-opencode-v1.14.46

marius-kilocode commented Jun 2, 2026

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Jun 2, 2026 •

edited

Loading

WARNING

SUGGESTION

Uh oh!

marius-kilocode commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

marius-kilocode commented Jun 2, 2026

1.14.46

Core

Improvements

Bugfixes

1.14.45

Core

Bugfixes

TUI

Bugfixes

Desktop

Bugfixes

SDK

Bugfixes

Extensions

Improvements

Bugfixes

1.14.44

Core

Bugfixes

1.14.43

Core

Bugfixes

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

WARNING

SUGGESTION

Uh oh!

marius-kilocode commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

kilo-code-bot Bot commented Jun 2, 2026 •

edited

Loading