Fix CLI models snapshot release validation

[catrielmuller]

Issue

No linked issue. This addresses a release-build regression where an invalid or broken generated models snapshot could pass publication build steps and only fail when the packaged CLI starts.

Context

The CLI build previously generated a giant mutable models-snapshot.js module from models.dev/api.json. Bun 1.3.14 can emit broken standalone binaries from that generated JS, and the publish workflow did not validate all packaged CLI binaries before the VS Code extension consumed them.

Implementation

The build now downloads, parses, validates, and canonicalizes the models.dev snapshot once before compiling CLI targets. The snapshot is stored as a JSON sidecar next to each packaged kilo binary instead of being compiled as a JS object literal.

The runtime model loader reads the sidecar or dev snapshot JSON when model metadata is needed. VS Code and JetBrains packaging paths copy/extract the sidecar alongside the CLI. Local VS Code development also refreshes the sidecar and falls back to a Bun source wrapper if local standalone compilation fails, so extension testing can still start the backend.

The publish workflow now validates supported Unix and Windows CLI artifacts with --version and --pure models anthropic before building VSIX packages.

Screenshots / Video

N/A, no visual changes.

How to Test

Manual/local verification

• Agent: bun test ./test/kilocode/provider/models-snapshot.test.ts from packages/opencode passed.
• Agent: bun run typecheck from packages/opencode passed.
• Agent: bun run check-types:extension from packages/kilo-vscode passed.
• Agent: ./gradlew typecheck from packages/kilo-jetbrains passed.
• Agent: bun run script/check-workflows.ts passed.
• Agent: parsed .github/workflows/publish.yml with the local Node yaml parser successfully.
• Agent: packages/kilo-vscode/bin/kilo --version returned local.
• Agent: packages/kilo-vscode/bin/kilo serve --port 0 started and printed a listening URL.
• Agent: pushing this branch ran the pre-push bun turbo typecheck hook successfully.

Reviewer test steps

1. Run bun test ./test/kilocode/provider/models-snapshot.test.ts from packages/opencode.
2. Run bun script/local-bin.ts --force from packages/kilo-vscode and confirm bin/kilo --version works.
3. Inspect the publish workflow graph and confirm build-vscode depends on validate-cli-unix and validate-cli-windows.
4. In a publish workflow dry run, confirm CLI validation runs before VSIX packaging and exercises models anthropic with model fetching disabled.

Blocked checks and substitute verification

• Agent: bun run script/build.ts --single from packages/opencode could not complete locally because the compiled Linux x64 standalone binary exits with code 139 during the existing --version smoke test in this Nix/Bun environment. Substitute verification was bun run typecheck, targeted snapshot tests, VS Code extension typecheck, JetBrains typecheck, local VS Code source-wrapper backend startup, and the pre-push bun turbo typecheck hook.

Checklist

• Issue linked above, or exception explained
• Tests/verification described
• Screenshots/video included for visual changes, or marked N/A
• Changeset considered for user-facing changes
• I personally reviewed the diff and can explain the changes, including any AI-assisted work.

Get in Touch

@catrielmuller

[kilo-code-bot]

WARNING: Variable shadowing — sourceSnapshotPath is already declared at module scope on line 35 (pointing to packages/opencode/src/provider/models-snapshot.json for the source-wrapper path). This inner const shadows it with the sidecar path next to the built binary, which is the correct value for this path, but the shadowing is confusing and will likely be flagged by the ESLint no-shadow rule.

Consider renaming the local to snapshotPath (consistent with the same helper in watch-cli.ts) or remove the module-level sourceSnapshotPath constant since it is only used inside writeSourceWrapper() where existsSync(sourceSnapshotPath) is called — that use could just inline the join(opencodeDir, "src", "provider", snapshotName) call or compute it from snapshotForBinary with a dev-mode sentinel.

[kilo-code-bot]

SUGGESTION: The snapshot is copied without first checking that the file exists. If the build produced the binary but somehow not the sidecar (e.g. a partial failure), cp will throw an ENOENT which is caught by the outer try/catch and logged as a generic ERROR. The binary will then be in place at targetBinPath without the accompanying snapshot.

Adding an existence check before the copy (similar to how local-bin.ts does it at line 105) would surface a clearer diagnostic. This is a dev-only watcher so the blast radius is small, but the resulting state (binary present, no snapshot) would cause the VS Code extension to fail to start on the next run with a confusing error.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Both issues from the previous review have been resolved in this commit:

• WARNING (resolved): Variable shadowing on sourceSnapshotPath — the module-level binding was renamed to devSnapshotPath (local-bin.ts:35), eliminating the collision with the inner binding at line 246.
• SUGGESTION (resolved): The snapshot is now checked for existence before copying in watch-cli.ts (lines 59–67), and an explicit error is logged if the snapshot is missing after a build.

The copy order change (snapshot before binary) in both files is consistent and intentional.

Files Reviewed (2 files, incremental)

• packages/kilo-vscode/script/local-bin.ts — previous WARNING resolved
• packages/kilo-vscode/script/watch-cli.ts — previous SUGGESTION resolved

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 267,579 tokens}

_{Review guidance: REVIEW.md from base branch main}