feat: port official and community platform fixes

.changeset/append-pretool-hook-output.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix successful PreToolUse hook output not being added to the model context.

.changeset/edit-refuse-large-delete.md

@@ -0,0 +1,6 @@
+---
+'@moonshot-ai/agent-core': patch
+'@moonshot-ai/kimi-code': patch
+---
+
+Refuse multi-line empty Edit deletions unless `allow_large_delete` is set, and tell the model to reread a large enough region after `old_string not found`.

.changeset/expand-kimi-code-home-tilde.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Expand `~` and `~/...` values in `KIMI_CODE_HOME` to the current user's home directory.

.changeset/fix-ajv-coerce-types.md

@@ -0,0 +1,7 @@
+---
+"@moonshot-ai/kimi-code": patch
+"@moonshot-ai/agent-core": patch
+"@moonshot-ai/agent-core-v2": patch
+---
+
+fix: coerce stringified tool args (numbers, booleans, JSON arrays/objects) before validation instead of rejecting them

.changeset/fix-tools-disabled-v1.md

@@ -0,0 +1,11 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+fix(agent-core): honor [tools].disabled config in v1 engine
+
+The `[tools].disabled` array in config.toml was silently ignored by the
+v1 engine (v2 has a dedicated toolPolicy service for this). Read the
+section from config.raw in bootstrapAgentProfile and merge it into the
+profile's disallowedTools so disabled tools are filtered from both the
+top-level tool list and the subagent Agent tool description.

.changeset/fork-stay-current-session.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+`/fork` no longer switches to the forked session: the current session stays active and its background tasks keep running. Find the fork in `/sessions`.

.changeset/kosong-skip-empty-think.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/kosong": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Skip empty OpenAI-compatible `reasoning_content` stream values so they are not journaled as no-op think parts.

.changeset/mcp-oauth-stale-redirect-registration.md

@@ -0,0 +1,5 @@
+---
+'@moonshot-ai/kimi-code': patch
+---
+
+Fixed MCP OAuth re-authorization always failing with "Invalid redirect URI": the OAuth callback listener binds a random port per flow, but the dynamic client registration recorded the first flow's port, so every later interactive authorization was rejected at the authorization endpoint. A stale registration is now dropped automatically and the flow re-registers with the current callback URI.

.changeset/mcp-structured-result-passthrough.md

@@ -0,0 +1,5 @@
+---
+'@moonshot-ai/kimi-code': patch
+---
+
+MCP tool results now surface the spec-defined `structuredContent` field and `_meta` server metadata to the model as a serialized `<mcp-structured-result>` block, instead of silently dropping them. Servers that return their machine-readable contract in these fields work the same as on other MCP hosts.

.changeset/plugin-managed-update-ebusy.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix managed plugin updates failing with EBUSY on Windows by rename-swapping the live directory instead of deleting it in place.

.changeset/preserve-provider-fallback.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Preserve the configured fallback provider when refreshing provider models.

.changeset/questions-colon-id-resolve.md

@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/kap-server": patch
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix submitting answers to interactive question prompts being rejected when the model provider returns tool call IDs containing colons (some OpenAI-compatible gateways).

.changeset/sse-mcp-servers.md

@@ -0,0 +1,8 @@
+---
+"@moonshot-ai/agent-core": minor
+"@moonshot-ai/acp-adapter": minor
+"@moonshot-ai/protocol": minor
+"@moonshot-ai/kimi-code": minor
+---
+
+Add support for legacy SSE MCP servers alongside stdio and streamable HTTP transports.

.changeset/trim-shell-transcript-turns.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Bound the transcript in `!`-heavy sessions: each shell command now groups as its own trimmable turn instead of piling into an untrimmable tail turn, and a finished command's stored stdout/stderr is capped to the last 64 KB per stream.

.changeset/v1-replay-profile-bind.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code-sdk": patch
+---
+
+Fix v1 replay ignoring v2 `profile.bind` records, which made sessions resumed from CLI-created wires lose their tool allowlist and send requests without `tools`.

.changeset/web-assets-cache-headers.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: Serve hashed static assets with long-lived immutable cache headers so repeat visits load faster.

.changeset/web-codeblock-long-line-pre.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+web: Keep chat code blocks readable when a plain-text fence has an ultra-long line by preferring the scrollable `<pre>` renderer and constraining stream-diffs overflow.

.changeset/web-history-text-coalesce.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Coalesce consecutive streamed text/thinking chunks in Kimi Web history reloads without inserting newlines.

.changeset/wsl-clipboard-image-sta.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix WSL image paste by running the Windows clipboard helper in STA mode and preferring the PNG clipboard format.

UPSTREAM_PORTS.md

@@ -12,6 +12,80 @@
 - KKM 对补丁进行了冲突融合，不保证 KKM 提交 SHA 与上游一致；上游 PR 与固定 head SHA 是来源依据。
 - 每次同步都必须更新本文件，并在 KKM PR 与 Release Notes 中引用对应批次。
 
+## Batch 2026-08-04 — 官方与社区通用修复
+
+KKM 分支：`agent/upstream-port-20260804`  
+目标基线：KKM `main` @ `f6fb808749e421bf1a6d767993a70889e65db863`  
+KKM PR：[Pidbid/kkm#5](https://github.com/Pidbid/kkm/pull/5)  
+状态：已完成移植与完整 CI 验证，等待通过 PR #5 合并到 `main`。
+
+本批次重新检查了上游已合并 PR 与仍开放的社区 PR。筛选标准仍是基础能力、可靠性、跨平台和协议兼容；不移植 Kimi 账号、登录、额度、托管配置、反馈、遥测身份等厂商业务。
+
+### KKM 移植提交
+
+| KKM commit | 内容 |
+|---|---|
+| `d2364c9c926a` | 首轮导入本批次筛选出的官方与社区通用修复 |
+| `dc029b8e0103` | 按 KKM 现有 SSE/MCP v2 布局消除重复实现并适配结构化结果 |
+| `3c2ce5ad9faf` | 复用现有 SSE 测试并补齐 shell 输出工具引用 |
+| `d274a0025a69` | 完成 session、参数纠正、Edit 快照兼容，并因架构前置缺失撤回 #2541 |
+| `c069f5095387`…`77c187b1bfb0` | 根据完整 CI 更新工具快照；最终代码树在 `77c187b1bfb0` 验证通过 |
+
+
+### 上游已合并（官方采纳）
+
+| Upstream PR | 固定 head SHA | 功能 | KKM 处理 |
+|---|---|---|---|
+| [#744](https://github.com/MoonshotAI/kimi-code/pull/744) | `3462a77c7785` | legacy SSE MCP：配置、ACP、插件、OAuth 与文档 | 与 KKM 已有实现对照融合，补齐缺口 |
+| [#2565](https://github.com/MoonshotAI/kimi-code/pull/2565) | `5d8ff30c6c77` | `/fork` 后保持在原会话，避免中断运行中的任务 | 按 KKM 品牌与现有会话 API 适配，并保留测试 |
+| [#2567](https://github.com/MoonshotAI/kimi-code/pull/2567) | `0dd51b89310a` | 恢复会话时回放 `profile.bind`，保留工具配置 | 完整移植 v1 兼容路径与测试 |
+| [#2585](https://github.com/MoonshotAI/kimi-code/pull/2585) | `b35eb4d54d22` | 支持包含冒号的 question/tool-call ID | 融合 KKM 的 session lifecycle 路径 |
+| [#2596](https://github.com/MoonshotAI/kimi-code/pull/2596) | `5387387a4208` | MCP `structuredContent` / `_meta` 传递给模型 | 移植当前 v1/v2 输出路径；不创建缺失的新版 `mcpCore` 树 |
+| [#2600](https://github.com/MoonshotAI/kimi-code/pull/2600) | `422c0d8e970a` | 过滤 MCP 协议保留的 `_meta` 键 | 与 #2596 成组移植并覆盖序列化测试 |
+| [#2609](https://github.com/MoonshotAI/kimi-code/pull/2609) | `a46bc7610e49` | OAuth token 更新时保留 `expiresAt` | 完整移植兼容路径与测试 |
+| [#2620](https://github.com/MoonshotAI/kimi-code/pull/2620) | `8cef67f8af8c` | OAuth 回调地址变化时废弃陈旧 client registration | 移植现有 v1 OAuth 路径；新版 `mcpCore` 部分暂缓 |
+
+### KKM 提前采用的开放社区 PR
+
+| Upstream PR | 固定 head SHA | 功能 | 风险控制 |
+|---|---|---|---|
+| [#2430](https://github.com/MoonshotAI/kimi-code/pull/2430) | `523b048e37cd` | Windows 下托管插件更新规避 `EBUSY` | rename-swap 小补丁，带回滚/测试 |
+| [#2452](https://github.com/MoonshotAI/kimi-code/pull/2452) | `6c2e94a12d0a` | Web 静态资源缓存头 | 上游 CI 已通过；仅缓存策略 |
+| [#2500](https://github.com/MoonshotAI/kimi-code/pull/2500) | `cf75a345e1d6` | 工具参数中字符串形式的 number/boolean/array 定向纠正 | 仅对类型失败字段重试，避免全局强制转换 |
+| [#2501](https://github.com/MoonshotAI/kimi-code/pull/2501) | `63677cd0db72` | provider 刷新时保留 fallback/default | 原子刷新路径与测试一并移植 |
+| [#2502](https://github.com/MoonshotAI/kimi-code/pull/2502) | `089d59a09b64` | 将成功的 PreToolUse hook stdout 追加到模型上下文 | 覆盖 turn、subagent、后台任务与 projector |
+| [#2508](https://github.com/MoonshotAI/kimi-code/pull/2508) | `1ce0e7ec0f8c` | 跳过空 reasoning 流片段 | KKM 已有更严格兼容逻辑；补齐关联路径 |
+| [#2509](https://github.com/MoonshotAI/kimi-code/pull/2509) | `09e6a339ac65` | Web 重载历史时合并连续流式文本/思考片段 | 按 KKM 已有块渲染逻辑手工融合，保留边界 |
+| [#2510](https://github.com/MoonshotAI/kimi-code/pull/2510) | `0265111eca76` | WSL 图片粘贴使用 PowerShell STA 与 PNG 格式 | 保留 KKM 的安全临时路径传递，补齐测试 |
+| [#2511](https://github.com/MoonshotAI/kimi-code/pull/2511) | `eb224a2c7143` | Edit 拒绝意外的大范围空替换删除 | v1/v2 编辑器实现与测试同步 |
+| [#2513](https://github.com/MoonshotAI/kimi-code/pull/2513) | `3314f6a731a1` | Web 超长代码行稳定渲染 | CSS/渲染性能小修复 |
+| [#2537](https://github.com/MoonshotAI/kimi-code/pull/2537) | `82958df646ef` | v1 正确遵守 `[tools].disabled` | 配置层小修复与单测 |
+| [#2544](https://github.com/MoonshotAI/kimi-code/pull/2544) | `eade0e38a592` | 展开 `KIMI_CODE_HOME=~/...` | 跨平台路径小修复 |
+| [#2603](https://github.com/MoonshotAI/kimi-code/pull/2603) | `1dee7cfbc9ad` | transcript fold 后回收旧 UI entry | 上游 CI 已通过；加入独立回归测试 |
+| [#2621](https://github.com/MoonshotAI/kimi-code/pull/2621) | `43446ed556f8` | 裁剪 shell-only transcript turn，并限制保存输出大小 | 上游 CI 已通过；与 KKM TUI 逻辑融合 |
+
+### 建议继续关注但本批次不合并
+
+| Upstream PR | 原因 / 后续条件 |
+|---|---|
+| [#2586](https://github.com/MoonshotAI/kimi-code/pull/2586) | MCP 非阻塞启动依赖 KKM 尚未引入的 v2 workspace/session lifecycle；需整套架构到位后移植 |
+| [#2608](https://github.com/MoonshotAI/kimi-code/pull/2608) | v2 MCP OAuth opt-in 全部位于缺失的新版 `mcpCore`；不能只移植半套 |
+| [#2573](https://github.com/MoonshotAI/kimi-code/pull/2573) | 自定义 Agent identity 涉及约 79 个文件且以 v2 为主，需单独设计迁移批次 |
+| [#2612](https://github.com/MoonshotAI/kimi-code/pull/2612) | Skill watcher 的 FD 修复依赖 #2366 的新 skill service 架构 |
+| [#2202](https://github.com/MoonshotAI/kimi-code/pull/2202) | 终端鼠标选择跨约 33 个文件，仍属实验性 UI 行为 |
+| [#2604](https://github.com/MoonshotAI/kimi-code/pull/2604) | minidb 大型重构，基础收益不足以覆盖迁移风险 |
+| [#2593](https://github.com/MoonshotAI/kimi-code/pull/2593) | engine-native image refs 仍为 draft，且依赖 v2 turn/wire |
+| [#2610](https://github.com/MoonshotAI/kimi-code/pull/2610) | session effort flag 跨 24 个文件，需先确认 KKM 对模型 effort 的统一策略 |
+| [#2541](https://github.com/MoonshotAI/kimi-code/pull/2541) | “保留迟到 Bash stdout”依赖 KKM 尚缺的新版 kaos wait/read 生命周期；独立移植会使 wait-before-read 与流错误测试挂起 |
+| [#2578](https://github.com/MoonshotAI/kimi-code/pull/2578), [#2579](https://github.com/MoonshotAI/kimi-code/pull/2579) | Web UI 小修可用但优先级低，等待与下一次 Web 专项批次合并 |
+
+### 本批次验证
+
+- 验证提交：`77c187b1bfb059bf139208bd66f628e8dae91609`
+- [CI run 30973570199](https://github.com/Pidbid/kkm/actions/runs/30973570199)：`lint`、`typecheck`、`build`、5 个测试分片和 `pi-tui` 全部通过；Windows job 按工作流条件跳过。
+- [Nix Build run 30973570206](https://github.com/Pidbid/kkm/actions/runs/30973570206)：flake workspace 同步检查和 `nix build .#kimi-code` 全部通过。
+- 合并记录：通过 [Pidbid/kkm#5](https://github.com/Pidbid/kkm/pull/5) 使用 merge commit 合并；该 PR 与本文件共同保留最终合并提交和逐项来源。
+
 ## Batch 2026-07-31 — 通用基础更新
 
 KKM 分支：`agent/upstream-port-20260731`  

apps/kimi-code/src/tui/commands/registry.ts

@@ -315,7 +315,7 @@ export const BUILTIN_SLASH_COMMANDS = [
   {
     name: 'fork',
     aliases: [],
-    description: 'Fork the current session',
+    description: 'Fork the current session into a copy without switching to it',
     priority: 80,
   },
   {

apps/kimi-code/src/tui/commands/session.ts

@@ -5,7 +5,6 @@ import { pathToFileURL } from 'node:url';
 import type { Session } from '@moonshot-ai/kimi-code-sdk';
 
 import { detectInstallSource } from '#/cli/update/source';
-import { CLI_COMMAND_NAME } from '#/constant/app';
 import { detectShellEnvironment } from '#/utils/process/shell-env';
 import { toTerminalHyperlink } from '#/utils/terminal-hyperlink';
 import { LLM_NOT_SET_MESSAGE, NO_ACTIVE_SESSION_MESSAGE } from '../constant/kimi-tui';
@@ -56,26 +55,27 @@ export async function handleForkCommand(host: SlashCommandHost, args: string): P
   }
 
   const sourceTitle = forkSourceTitle(host, session);
-  let forked: Session;
   try {
-    forked = await host.harness.forkSession({
+    const forked = await host.harness.forkSession({
       id: session.id,
       title: `Fork: ${sourceTitle}`,
     });
-  } catch (error) {
-    const msg = formatErrorMessage(error);
-    host.showError(`Failed to fork session: ${msg}`);
-    return;
-  }
-
-  try {
-    await host.switchToSession(
-      forked,
-      `Session forked (${forked.id}). To return to the original session: ${CLI_COMMAND_NAME} -r ${session.id}`,
+    const forkId = forked.id;
+    try {
+      await forked.close();
+    } catch (error) {
+      const msg = formatErrorMessage(error);
+      host.showError(`Session forked (${forkId}), but failed to release its runtime: ${msg}`);
+      return;
+    }
+    // Stay in the source session: switching to the fork would close the source,
+    // killing its in-flight turn and background tasks.
+    host.showStatus(
+      `Session forked (${forkId}). Still in the original session; switch to the fork via /sessions.`,
     );
   } catch (error) {
     const msg = formatErrorMessage(error);
-    host.showError(`Failed to switch to forked session: ${msg}`);
+    host.showError(`Failed to fork session: ${msg}`);
   }
 }
 

apps/kimi-code/src/tui/kimi-tui.ts

@@ -144,7 +144,7 @@ import { extractMediaAttachments, rewriteMediaPlaceholders } from './utils/image
 import { REPLAY_TURN_LIMIT } from './utils/message-replay';
 import { hasPatchChanges } from './utils/object-patch';
 import { sessionRowsForPicker } from './utils/session-picker-rows';
-import { formatBashOutputForDisplay } from './utils/shell-output';
+import { capStoredShellOutput, formatBashOutputForDisplay } from './utils/shell-output';
 import { combineStartupNotice, isOAuthLoginRequiredError } from './utils/startup';
 import { installTerminalFocusTracking } from './utils/terminal-focus';
 import { installEditorMouseTracking } from './utils/editor-mouse';
@@ -1167,10 +1167,18 @@ export class KimiTUI {
       // the UI and the model notification, so there is nothing to render here.
       return;
     }
-    stream.component.finish(stdout, stderr, isError);
+    stream.component.finish(
+      capStoredShellOutput(stdout),
+      capStoredShellOutput(stderr),
+      isError,
+    );
     // Keep the transcript entry's metadata in sync for anything that reads it
     // (export / copy). The component renders itself.
-    stream.entry.content = formatBashOutputForDisplay(stdout, stderr, isError);
+    stream.entry.content = formatBashOutputForDisplay(
+      capStoredShellOutput(stdout),
+      capStoredShellOutput(stderr),
+      isError,
+    );
     this.shellOutputStreams.delete(commandId);
     // When the last shell command finishes, leave the shell streaming phase,
     // release one queued message (if any), and refresh the activity pane.
@@ -2324,15 +2332,30 @@ export class KimiTUI {
       newChildren.push(children[i]!);
     }
 
-    for (const idx of toMergeIndices) {
-      const child = children[idx]!;
+    const mergedChildren = toMergeIndices.map((idx) => children[idx]!);
+    for (const child of mergedChildren) {
       if (hasDispose(child)) child.dispose();
     }
+    // The merged components are gone; their transcript entries have to go
+    // too, or the entry list keeps growing underneath the folded tree.
+    this.dropTranscriptEntriesOf(mergedChildren);
 
     children.splice(0, children.length, ...newChildren);
     return true;
   }
 
+  private dropTranscriptEntriesOf(components: readonly Component[]): void {
+    const dropped = new Set<TranscriptEntry>();
+    for (const component of components) {
+      const entry = getTranscriptComponentEntry(component);
+      if (entry !== undefined) dropped.add(entry);
+    }
+    if (dropped.size === 0) return;
+    this.state.transcriptEntries = this.state.transcriptEntries.filter(
+      (entry) => !dropped.has(entry),
+    );
+  }
+
   mergeAllTurnSteps(): void {
     if (TRANSCRIPT_KEEP_RECENT_STEPS <= 0 && TRANSCRIPT_KEEP_RECENT_ASSISTANT_COMPLETED <= 0)
       return;
@@ -2409,6 +2432,7 @@ export class KimiTUI {
     for (const child of toDispose) {
       if (hasDispose(child)) child.dispose();
     }
+    this.dropTranscriptEntriesOf(toDispose);
     children.splice(0, children.length, ...newChildren);
   }
 

apps/kimi-code/src/tui/utils/shell-output.ts

@@ -69,3 +69,22 @@ export function formatBashOutputForDisplay(stdout: string, stderr: string, isErr
     return plain.length > 0 ? plain : '(no output)';
   }
 }
+
+/** Cap on each stored stream once a command finishes; the tail is what matters. */
+export const MAX_STORED_STREAM_CHARS = 64 * 1024;
+
+/**
+ * Bound a finished command's stored output. The running buffer is already
+ * capped mid-stream (see ShellRunComponent), but the final copies used to be
+ * stored whole: one inside the component, one formatted into the transcript
+ * entry, so a `! cat bigfile` habit grew the session without bound. Keep the
+ * tail and say on the first line how much was dropped.
+ */
+export function capStoredShellOutput(text: string, maxChars = MAX_STORED_STREAM_CHARS): string {
+  if (text.length <= maxChars) return text;
+  let tail = text.slice(-maxChars);
+  // Do not start the kept text on the low half of a surrogate pair.
+  const first = tail.codePointAt(0);
+  if (first !== undefined && first >= 0xdc00 && first <= 0xdfff) tail = tail.slice(1);
+  return `… (${text.length - tail.length} earlier chars truncated)\n${tail}`;
+}

apps/kimi-code/src/tui/utils/transcript-window.ts

@@ -69,8 +69,11 @@ export interface TranscriptTurn {
  * defined turn. This matters because a user message is appended (with
  * `turnId: undefined`) before its turn actually starts, so without this
  * buffering every user message would become its own single-entry turn at the
- * front and get trimmed first. Any undefined entries left at the tail (no
- * following turn) become their own turn.
+ * front and get trimmed first. A buffered run is flushed into its own turn
+ * when the next user entry arrives: `!` shell echoes are user entries too,
+ * but no defined turn ever follows them, so each one starts a fresh group.
+ * Any undefined entries left at the tail (no following turn) become their
+ * own turn.
  */
 export function groupTurns(entries: readonly TranscriptEntry[]): TranscriptTurn[] {
   const turns: TranscriptTurn[] = [];
@@ -80,6 +83,14 @@ export function groupTurns(entries: readonly TranscriptEntry[]): TranscriptTurn[
   for (const entry of entries) {
     const turnId = entry.turnId;
     if (turnId === undefined) {
+      // A `!` shell echo is a user entry with no turnId, and no defined turn
+      // ever follows it. Flush the buffered entries at each one so a
+      // `!`-heavy stretch becomes many small trimmable turns instead of a
+      // single tail turn that turnsToTrim can never touch.
+      if (entry.kind === 'user' && pendingUndefined.length > 0) {
+        turns.push({ turnId: undefined, entries: pendingUndefined });
+        pendingUndefined = [];
+      }
       pendingUndefined.push(entry);
       continue;
     }