This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@vyl/kimi-code@0.37.0

Minor Changes

• #2935 44a6c70 Thanks @chengluyu! - Activate multiple skills in a single prompt. Type / after whitespace to insert a skill token; all referenced skills run with the prompt as one turn (and undo as one unit).

• #2633 f492cd7 Thanks @tpoisonooo! - Add the /tower slash command to orchestrate multiple agents iterating on one repo in parallel — you act as the control tower while worker agents execute missions in their own git worktrees. Run /tower to start.

Patch Changes

• #2593 d833a1a Thanks @7Sageer! - Keep pasted image and video attachments available in session history, and clean up temporary uploads automatically.

• #2972 04d23e2 Thanks @sailist! - Fix UTF-8 text files containing Chinese or emoji being misdetected as binary, so log files preview correctly in the web UI.

• #2633 f492cd7 Thanks @tpoisonooo! - Fix several seconds of startup lag: the global search index (used only by the web UI's search) was being opened and synced in every terminal session, including ones that never search. It now loads on demand, so interactive startup stays fast.

• #2969 ee564e5 Thanks @sailist! - Persist the token counting ledger (token_counting.measured / truncated / rebased) to the wire journal, so the displayed context size keeps its measured value after archiving and unarchiving a session (or any close → resume) instead of dropping to a smaller estimate until the next LLM call.

• #2633 f492cd7 Thanks @tpoisonooo! - Queue slash skill commands entered while the agent is busy instead of rejecting them with "Cannot / while streaming" — they now behave exactly like normal input: queued visibly by default, and Ctrl-S steers them into the running turn as real skill activations.

• #2858 59dde73 Thanks @7Sageer! - On the legacy engine, plugin MCP server changes (install / enable / disable / remove / reload) now apply to open sessions immediately, and an MCP server OAuth sign-in or credential reset automatically refreshes the affected sessions instead of leaving them stuck until a manual reconnect; a connection that fails mid-session for auth reasons is now reported as needing sign-in rather than as a generic failure.

  @moonshot-ai/kimi-code-sdk: the MCP management surface is now backed by a unified, source-tagged registry — listMcpServers also covers plugin-declared servers (read-only, with their effective config) and returns source / origin / mutable markers; new getMcpServer for a single effective config; testMcpServerConfig probes an unsaved inline config; sessions can connect a server at runtime via addMcpServer with an optional persist flag; reconnectMcpServer accepts an optional replacement config and otherwise re-resolves the current config instead of reusing a stale snapshot; listMcpServerAuthStatuses accepts cwd / verify (online probe) and distinguishes dead grants via the new oauth-expired state; stored OAuth grants now record their absolute expiry and are refreshed proactively and single-flight per credential. Session status entries and read-only management entries redact secret-bearing stdio env / remote headers values to key lists, and concurrent logins for the same credential join a single browser flow. A new app-level inspection, inspectAppMcpServers, reports every server's effective config and real (probe-verified) authorization state — including plugin servers and runtime-name collisions — and the OAuth flow RPCs have locator-addressed variants (authenticateAppMcpServer / resetAppMcpServerAuth) so plugin servers can be signed in and reset directly.

@moonshot-ai/kimi-code-sdk@0.19.0

Minor Changes

• #2593 d833a1a Thanks @7Sageer! - Daemon file references no longer persist a materialization path: the daemon-file URL builder takes only a file id, and the parsed reference no longer carries a path field. The display path is derived from the session media store at read time, so a session fork or home relocation can no longer stale a persisted reference. Urls with a legacy ?path= query still parse.

• #2934 61591bc Thanks @chengluyu! - Add session.promptWithSkills(input, skills) to submit one prompt with one or more skill activations bundled into the same user message — one turn, one undo unit (v2 engine only; rejects on the v1 engine).

• #2593 d833a1a Thanks @7Sageer! - Add uploadFile for uploading media to the engine's file store and referencing it from prompts, plus an optional promptId on prompt submissions for correlating them with turn-started events. Both require the v2 harness.

• #2858 59dde73 Thanks @7Sageer! - On the legacy engine, plugin MCP server changes (install / enable / disable / remove / reload) now apply to open sessions immediately, and an MCP server OAuth sign-in or credential reset automatically refreshes the affected sessions instead of leaving them stuck until a manual reconnect; a connection that fails mid-session for auth reasons is now reported as needing sign-in rather than as a generic failure.

  @moonshot-ai/kimi-code-sdk: the MCP management surface is now backed by a unified, source-tagged registry — listMcpServers also covers plugin-declared servers (read-only, with their effective config) and returns source / origin / mutable markers; new getMcpServer for a single effective config; testMcpServerConfig probes an unsaved inline config; sessions can connect a server at runtime via addMcpServer with an optional persist flag; reconnectMcpServer accepts an optional replacement config and otherwise re-resolves the current config instead of reusing a stale snapshot; listMcpServerAuthStatuses accepts cwd / verify (online probe) and distinguishes dead grants via the new oauth-expired state; stored OAuth grants now record their absolute expiry and are refreshed proactively and single-flight per credential. Session status entries and read-only management entries redact secret-bearing stdio env / remote headers values to key lists, and concurrent logins for the same credential join a single browser flow. A new app-level inspection, inspectAppMcpServers, reports every server's effective config and real (probe-verified) authorization state — including plugin servers and runtime-name collisions — and the OAuth flow RPCs have locator-addressed variants (authenticateAppMcpServer / resetAppMcpServerAuth) so plugin servers can be signed in and reset directly.

kimi-code@0.7.1

Patch Changes

• #2858 59dde73 Thanks @7Sageer! - On the legacy engine, plugin MCP server changes (install / enable / disable / remove / reload) now apply to open sessions immediately, and an MCP server OAuth sign-in or credential reset automatically refreshes the affected sessions instead of leaving them stuck until a manual reconnect; a connection that fails mid-session for auth reasons is now reported as needing sign-in rather than as a generic failure.

  @moonshot-ai/kimi-code-sdk: the MCP management surface is now backed by a unified, source-tagged registry — listMcpServers also covers plugin-declared servers (read-only, with their effective config) and returns source / origin / mutable markers; new getMcpServer for a single effective config; testMcpServerConfig probes an unsaved inline config; sessions can connect a server at runtime via addMcpServer with an optional persist flag; reconnectMcpServer accepts an optional replacement config and otherwise re-resolves the current config instead of reusing a stale snapshot; listMcpServerAuthStatuses accepts cwd / verify (online probe) and distinguishes dead grants via the new oauth-expired state; stored OAuth grants now record their absolute expiry and are refreshed proactively and single-flight per credential. Session status entries and read-only management entries redact secret-bearing stdio env / remote headers values to key lists, and concurrent logins for the same credential join a single browser flow. A new app-level inspection, inspectAppMcpServers, reports every server's effective config and real (probe-verified) authorization state — including plugin servers and runtime-name collisions — and the OAuth flow RPCs have locator-addressed variants (authenticateAppMcpServer / resetAppMcpServerAuth) so plugin servers can be signed in and reset directly.

• Updated dependencies [d833a1a, 61591bc, d833a1a, 59dde73]:

  • @moonshot-ai/kimi-code-sdk@0.19.0

@moonshot-ai/acp-adapter@0.3.10

Patch Changes

• Updated dependencies [d833a1a, 61591bc, d833a1a, 59dde73]:
  • @moonshot-ai/kimi-code-sdk@0.19.0

@moonshot-ai/pi-tui@0.84.4

Patch Changes

• #2935 44a6c70 Thanks @chengluyu! - Add an opt-in inline slash autocomplete trigger that fires after whitespace mid-input and at the start of subsequent editor lines.