@moonshot-ai/kimi-code@0.20.1

Patch Changes

• #1125 e9a3b7c - Add an update alias for the kimi upgrade command. Run kimi update to upgrade to the latest version.

• #1122 820d77a - Show the done / in progress / pending breakdown of hidden todos in the collapsed todo panel.

• #1131 76c643b - Cap completion tokens to the remaining context window for chat-completions providers, avoiding context-overflow and invalid max_tokens errors.

• #1120 e736349 - Add optional feedback attachments for diagnostic logs and codebase context.

• #1135 bf51fb7 - Fix the local server failing to start on Windows after the first run because the persistent token file's synthesized mode was rejected as too permissive.

• #1102 9c97161 - Harden the default system prompt and built-in tool descriptions: stop the agent from blocking on background tasks it should let run, keep its guidance matched to the tools each profile actually provides, and surface tool-result details (fetched-page mode, Grep match totals) it previously missed.

• #1127 184acf5 - Plugins can now declare hooks in their manifest to run scripts on lifecycle events.

• #1128 0886bff - Add a --allowed-host flag to kimi server run that lets extra Host header values pass the DNS-rebinding check, and include allow guidance in the 403 error message. Pass --allowed-host to allow an extra host.

• #1119 b0b2aee - Keep the terminal responsive in long conversations by caching rendered message lines.

• #1119 b0b2aee - Keep long sessions responsive by retaining only recent turns in the transcript and collapsing older steps within each turn.

• #1121 81ba48f - Make the web chat input grow with its content and add an expandable editor for longer messages.

• #1133 f1c8175 - Fix the /web slash command not carrying the server token, so the opened web UI signs in automatically and the token is shown before the terminal exits.

@moonshot-ai/kimi-code@0.20.0

Minor Changes

• #1079 2db5fc2 - Add shell mode for running shell commands.
  Type ! in the input box to enable it.
  The command output is visible to the AI.
  For long-running commands, press Ctrl+B to move them to the background.
  For example, you can run !gh auth login to sign in to the GitHub CLI without opening a new terminal, so Kimi can use gh.

• #1088 0030f76 - Add a confirmation prompt before installing third-party plugins.

• #1066 3554f7e - Show update badges on the /plugins Installed tab, where Enter now installs the available update and I opens plugin details.

• #1025 5ef66dd - Redesign /plugins as a single tabbed panel: Installed (manage installed
  plugins — toggle, remove, MCP, details, reload), Official (Kimi-maintained
  marketplace plugins), Third-party (marketplace plugins from other
  publishers), and Custom (install straight from a GitHub URL, zip URL, or
  local path). Tab / Shift-Tab switch tabs. The Official and Third-party
  catalogs load lazily, so /plugins opens instantly and keeps working offline —
  a marketplace fetch failure is shown inline instead of closing the panel. The
  tab strip is shared with the /model provider tabs via the new renderTabStrip
  helper.

• #1006 60dfb68 - Add server authentication and safe --host exposure. The local server now
  requires a per-start bearer token on all API and WebSocket calls (the CLI reads
  it automatically), enforces Host/Origin checks, and gains --host with a
  public-binding hardening tier: mandatory KIMI_CODE_PASSWORD, TLS (or
  --insecure-no-tls), auth-failure rate limiting, disabled remote
  shutdown/terminals, and security response headers. See packages/server/SECURITY.md.

• #1040 6664038 - Replace silent AGENTS.md truncation with a visible warning in the TUI status bar and web UI.

• #1101 3ea6ac2 - Show the plan body and approach choices in the plan review card when exiting plan mode in the web UI.

• #1103 18f7c34 - Show a line-by-line diff when the agent edits or writes a file in the web chat.

Patch Changes

• #1072 a86bb97 - Improve the image paste hint.

• #1076 500677a - Fix Ctrl-C during compaction so it clears a pending editor draft first instead of cancelling immediately.

• #1067 0e227ba - Fix explore subagents silently losing git context when git commands time out or the directory is not a repository.

• #1075 3aaf1e5 - Fix a startup crash on Linux caused by an unhandled native clipboard error.

• #1094 8ee5c0f - Fix the terminal window repeatedly losing focus on Linux Wayland, which broke IME input.

• #1057 ee69e16 - Fix MCP server working directories when sessions are hosted by the web server.

• #1064 a752a53 - Fix truncated skill descriptions missing an ellipsis in the model's skill listing.

• #903 bbd8a1a - Fix kimi web and /web failing to start the background server daemon on Windows with spawn EFTYPE when the CLI is installed via npm/pnpm or run from source. The official single-binary install script was not affected.

• #1070 ff17715 - Stop auto-dismissing questions in the web UI after 60 seconds so they wait for the user's answer.

• #1097 27ef516 - Add a hint to the per-turn step limit error pointing users to the loop_control.max_steps_per_turn config option.

• #1062 ea6a4bf - Preserve full tool output logs when previews are truncated and link background task completion notifications to saved output.

• #1086 fe667d7 - /reload now refreshes the assistant's view of plugin skills, so plugin changes take effect in the current session instead of requiring a new one.

• #1081 8fc6aa5 - Sync session title changes across all connected clients in server mode.

• #1078 75ca3b2 - Add Ctrl+U and Ctrl+D as page up and page down shortcuts in the task output viewer.

• #1069 d18aa16 - Reduce streaming redraw cost for long assistant messages with code blocks.

• #1112 6a97d0b - Add a copy button to user messages in the web chat.

• #1035 ea03f30 - Render LaTeX display math ($$…$$) in the web chat via KaTeX. Single $ is intentionally left as literal text, so prices, env vars, and shell paths (e.g. $PATH, $5/$10, $HOME/bin) are never swallowed as a formula.

• #1084 d6e5246 - Page the web session list per workspace so the first screen no longer fetches every session up front.

• #1113 6194d3f - Keep the web session sidebar from re-rendering on every streaming token. The
  event reducer now reuses the sessions array reference for events that do not
  change sessions, so the sidebar computeds (sessionsForView / workspaceGroups
  / mergedWorkspaces) are no longer dirtied by unrelated high-frequency events.

• #1087 884b65a - Fix duplicate session snapshot reloads in the bundled web UI during resync.

• #1109 d554f9a - Show the full accumulated progress of a subagent in its detail panel, with concise tool-call summaries instead of raw JSON.

• #1065 4b837d6 - Create missing parent directories automatically when writing a file.

@moonshot-ai/kimi-code@0.19.2

Patch Changes

• #999 6b68aa8 - Add -c as a shorthand for --continue.

• #1028 be77d5d - Show a transient footer hint when an image is detected in the clipboard, displaying the platform-appropriate paste shortcut.

• #1004 d70c3a8 - Show the command in running Bash tool cards and allow expanding it with Ctrl+O before the result arrives.

• #1009 e47de61 - Add a Ctrl+T shortcut to expand and collapse a truncated todo list.

• #1028 be77d5d - Fix stale rows occasionally leaving duplicate input boxes after tall content shrinks.

• #1028 be77d5d - Fix inline images being rendered as broken escape sequences in the transcript.

• #1027 c240bfa - Fix resume not realigning a tool call that was interrupted mid-history. The synthetic interrupted result is now closed in place at the next step boundary, so later turns and deferred messages keep their recorded order instead of only the trailing exchange being repaired. The /messages wire transcript reducer mirrors the same closure so its folded length stays aligned with live history, preventing the later turn from being duplicated/reordered. Replay also drops a tool result whose call is no longer awaiting one, so a stale interrupted result left at the log tail by an older resume of a damaged session is not re-applied as a duplicate.

• #1012 fd16ffb - Show subcommand suggestions after Tab-completing a slash command name.

• #1012 fd16ffb - Fix the Tab key unexpectedly opening the file completion list.

• #1044 9d197e0 - Fix clipboard copy actions in the web UI when served over plain HTTP.

• #1032 a753b05 - Fix code blocks nested inside list items rendering blank in the web chat after a turn finishes generating.

• #1015 83384ee - Fix the composer's ↑/↓ input-history recall doing nothing right after the first message of a new session. The history is now persisted to localStorage and re-read on mount, so the docked composer no longer starts empty when it takes over from the empty-session composer. Slash commands are now recorded too — both typed-and-submitted and ones picked from the slash menu — so they can be recalled like plain messages.

• #1003 e15edfd - Fix the web question prompt missing the free-text Other option.

• #1056 b93e936 - Fix yolo mode in the web app auto-approving plan reviews and sensitive file access.

• #971 b84704b - Read large text files in bounded memory and read tail lines without scanning whole files.

• #1020 9c553e4 - Add an Alt+S shortcut in the model picker to switch the model for the current session only, without saving it as the default.

• #1043 27df39c - Fix web chat stop actions so stale prompt ids fall back to cancelling the active session.

• #1036 866b91c - Reorganize the web app's components into area subdirectories (chat/settings/dialogs/mobile) and refresh the component path comments.

• #1042 dc6b9ef - Add a development-mode indicator to the web sidebar for local development.

• #1047 98d3e5b - Keep the web sidebar's workspace order stable and let workspaces be reordered by drag-and-drop, persisted locally instead of following recent activity; sessions now also float to the top of their group as soon as a new message arrives.

• #1034 603a767 - Extract the composer's image/video attachment handling into a reusable composable.

• #1031 2bfd686 - Extract the composer's text state and per-session draft persistence into a reusable composable.

• #1011 fb780fc - Extract the composer's shell-style input-history recall into a reusable composable.

• #1030 661c1fb - Extract the composer's @-mention menu logic into a reusable composable.

• #1026 318c964 - Extract the composer's slash-command menu logic into a reusable composable.

• #1045 ac1882f - Persist the collapsed state of workspace groups in the web sidebar across page reloads.

• #1001 ea1b33b - Extract pure turn-rendering helpers out of the chat pane into their own module.

• #1010 a2650f8 - Extract the beta conversation outline (table of contents) into its own component.

• #998 3e4793d - Extract the workspace group rendering out of the sidebar into its own component.

• #985 92c2cf0 - Allow the web sidebar and detail panel to be resized up to the available viewport width, keeping their resize handles reachable on narrow windows.

• #1033 b1e6b64 - Optimize the loading tips display.

@moonshot-ai/kimi-code@0.19.1

Patch Changes

• #992 7341fb4 - Fix ACP editors such as Zed failing to start a new thread.

• #984 da81858 - Clear all per-session state when a session is archived or removed, so archived sessions no longer leave orphaned data behind.

• #978 d4ae02d - Fix the web sidebar's unread dots getting out of sync across browser tabs.

• #979 8c6cade - Consolidate web client localStorage access and split the root state store and app shell into focused composables.

@moonshot-ai/kimi-code@0.19.0

Minor Changes

• #812 c0eeca2 - Added the ability to add extra workspace directories:

  • Use the /add-dir <path> command to add extra working directories to the current session, or remember them for the project.
  • Use kimi --add-dir <path> to add them on startup.
  • Project-level local config is now managed in .kimi-code/local.toml; we recommend adding it to your .gitignore.

• #975 c5c1834 - Speed up session snapshot loading with a direct disk reader and a request timeout safeguard, keeping the previous path as a legacy fallback.

Patch Changes

• #910 7644f10 - Fix provider requests failing when restored conversation history contains empty text content blocks.

• #963 4292ae9 - Surface provider safety-policy blocks instead of silently treating them as completed turns, and prevent the context token count from dropping to zero after a filtered response.

• #970 2730079 - Detect the real image format from file contents when reading media, so a mismatched filename extension no longer produces a data URL the model API rejects.

• #977 d521932 - Stop showing unread dots on cancelled or failed sessions in the web sidebar.

• #957 b57fc90 - Fix commands flashing an empty console window on Windows.

• #821 ba64072 - Allow long-running foreground commands and subagents to be moved into background tasks with Ctrl+B, and inspect them via the /tasks panel.

• #812 c0eeca2 - Polish file mention UX.

• #974 d434d8f - Unify image format detection when sniffing fails.

• #958 98905eb - Show longer branch names in the web chat header and expose the full name on hover.

• #964 4223739 - Keep the web page title fixed instead of changing with the session or workspace name.

• #973 3b9938b - Consolidate web client localStorage access and decouple appearance/notification state into dedicated modules.

@moonshot-ai/kimi-code@0.18.0

Minor Changes

• #888 58898de - Add an environment variable to cap AgentSwarm concurrency during the initial ramp, so large swarms do not trip provider rate limits as easily.

• #895 495fe8c - Add instant session search to the web sidebar, filtering by title and the last user prompt.

Patch Changes

• #896 de610de - Fix the web workspace session count so it drops to 0 after archiving the last session instead of staying at 1.

• #876 49183d8 - Suggest /reload alongside /new in plugin-change hints.

• #867 d1dc2a3 - Redesign the web OAuth login dialog: lead with a single "Authorize in browser" button that opens the verification link with the device code already embedded, demote manual code entry to a clearly secondary fallback, and drop the duplicate open-browser and cancel controls so the order of steps is unambiguous.

• #867 d1dc2a3 - Fix the web login slash command description to match the browser authorization flow.

• #893 d7ec056 - Add scroll-up lazy loading for older messages in the web chat session view, and fix the "new messages" pill overlapping the composer dock.

• #882 8ab9e96 - Fix the web app only loading the 20 most recent sessions; it now follows pagination so older sessions are reachable.

• #889 23277a5 - Show the connected server version in the web settings General tab.

• #881 7bc3d99 - Keep the highlighted web slash command visible while navigating a long slash menu.

• #878 a74a6b7 - Allow long web slash command names and descriptions to wrap without overflowing the slash menu.

• #878 a74a6b7 - Fix web slash skill selection sending immediately and allow slash search to match skill names by substring.

@moonshot-ai/kimi-code@0.17.1

Patch Changes

• #861 bd09795 - Prevent the web login dialog from closing when clicking the backdrop.

• #860 0e2877b - Stop the background local server from locking the directory it was started in.

• #860 0e2877b - Fix the local server failing to start in the background on the native binary.

• #861 bd09795 - Group the default model dropdown in web settings by provider.

@moonshot-ai/kimi-code@0.17.0

Minor Changes

• #625 9a8fea5 - Add the server-hosted web UI and the CLI commands that power it:

  • kimi server to start, stop, and manage the local server.
  • kimi web to open the server-hosted web UI in a browser.
  • Server REST and WebSocket APIs for the web client.
  • Web chat layout, session list, auto-scroll, and related behaviors.

Patch Changes

• #838 843a731 - Show the underlying connection error when OAuth token refresh fails after internal retries, instead of prompting for login. Token refresh failures are no longer re-retried at the agent loop level.

• #849 254f946 - Skip debug TPS when the output stream is too short to measure reliably.

• #833 a71b2e3 - Restore the turn counter from persisted loop events on resume so post-resume turns no longer reuse turn ids that already appear in history.

• #853 05fe759 - Fix the web login page and no-workspace conversation startup flow.

@moonshot-ai/kimi-code@0.16.0

Minor Changes

• #788 efdf8a1 - Add a built-in kimi vis command that launches the session visualizer in your browser, pointed at your local sessions. Supports --port/--host, --no-open, and kimi vis <sessionId> deep-links.

Patch Changes

• #790 d0d5821 - Stop Anthropic-compatible providers from reading ambient Anthropic shell credentials and custom headers.

• #809 6f442bd - Add configurable banner display frequencies with local display state.

• #807 b45672c - Close wrapped output streams when buffered readers are destroyed.

• #813 7b5b818 - Fix repeated compaction handling when context remains over the blocking threshold.

• #801 ff332be - Polish queue pane styling

• #802 aa1896c - Reduce the maximum height of the /btw side panel from half to one-third of the terminal.

• #805 3e6196e - Project session replay ranges over rendered replay records instead of raw persisted records.

• #804 299b9fc - Prevent session shutdown from resuming the agent when stopping background tasks.

• #823 90fc04b - Remove redundant LLM request logging context plumbing.

@moonshot-ai/kimi-code@0.15.0

Minor Changes

• #779 2746c71 - Add an all-sessions picker view with name search, paginated browsing, and clipboard-ready resume commands for sessions in other working directories.

• #744 18f299f - Add support for legacy SSE MCP servers alongside stdio and streamable HTTP transports.

Patch Changes

• #777 4516f62 - Clarify AGENTS.md prompt guidance and mark truncated instruction files.

• #780 8a92db6 - Prompt the CLI to show one brief same-language status sentence before non-trivial tool calls.

• #786 e10b25f - Stop writing resume version markers into persisted agent metadata.

• #768 c6a9967 - Recover resumed sessions when an interrupted tool call result was not recorded.

• #775 3fa1b8e - Optimize the npm packaging system.

• #343 73be7ba - Repair mismatched JSON Schema types emitted by Xcode 26.5 MCP server for Moonshot compatibility.

• #777 4516f62 - Collapse hidden directories in the workspace prompt and explain how to inspect them.

• #766 9cef896 - Clarify that compaction summaries must be emitted in the final answer.

• #765 046856b - Read media files using header-detected types before falling back to media extensions.

• #779 2746c71 - Show the all-sessions toggle hint when the current working directory has no sessions.

• #785 4578f05 - Include the skill's directory on the loaded-skill context block so the agent can locate a skill's bundled resources (scripts, templates) after it is invoked.

• #784 a562ef5 - Decouple agent skill access from session-specific registry implementations.

• #772 d47e699 - Do not carry obsolete legacy loop, background, plan, yolo, or unknown experimental flags into migrated config files.

• #783 e2a407c - Keep TUI components within narrow terminal widths by wrapping, compacting, or truncating lines that could exceed the render width.

• #776 ecd7a0a - Resolve model capabilities through a static lookup instead of instantiating a temporary provider.

• #767 a355f2a - Prioritize clearing draft editor text before Ctrl-C cancels an active stream.

• #787 1eb363f - Extend the same-language rule to the model's reasoning, so thinking follows the user's language while keeping code and technical terms in their original form.