feat(jetbrains): download pinned Kilo Core releases at runtime by kirillk · Pull Request #11975 · Kilo-Org/kilocode

kirillk · 2026-07-06T19:09:49Z

What

Download the pinned Kilo Core/CLI release when the JetBrains backend connects instead of bundling CLI binaries in the plugin ZIP.
Generate the JetBrains OpenAPI client from the pinned tagged CLI release, and verify downloaded archives with GitHub release SHA-256 digests before extraction/execution.
Surface download progress and runtime Core info through backend app/RPC state, with logs for cache hits, reinstall/download progress, digest failures, and GitHub API rate-limit diagnostics.
Update the JetBrains publish/release docs and workflow so releases no longer prepare or rebuild CLI resources as part of plugin packaging.

Why

JetBrains Marketplace enforces a 400 MB plugin size cap. Bundling all platform CLI binaries risks pushing the plugin toward that limit as the CLI grows; runtime download keeps the Marketplace package small.
JetBrains plugin releases should not need to rebuild the CLI for every JetBrains-only release. Pinning a tagged Kilo Core release lets the plugin ship independently while still using a reviewed, published CLI artifact.
Generating the client from the same pinned release used at runtime keeps the JetBrains RPC/client surface aligned with the Core version users actually run.
Digest verification preserves integrity for both build-time client generation and runtime first-connect downloads.

Validation

./gradlew typecheck
./gradlew :backend:test --tests ai.kilocode.backend.cli.KiloCliDownloaderTest --tests ai.kilocode.backend.app.KiloBackendAppServiceTest --tests ai.kilocode.backend.workspace.KiloBackendWorkspaceTest
bun run script/check-workflows.ts
bun run script/check-md-table-padding.ts

kilo-code-bot · 2026-07-06T19:43:53Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This increment adds two commits since the last review: pruning stale cached CLI versions after a successful resolve (keeping only the pinned/active version and deleting the extracted archive), and splitting the collapsed "release did not include asset" error into distinct, logged messages for missing asset / missing digest / malformed digest cases. Both changes are covered by new unit tests exercising the real KiloCliDownloader implementation (no mocking of the class under test). All 13 previously flagged findings across this PR already carry a "Fixed by" reply from the author confirming resolution, and no new issues were found in the changed code for this increment.

Files Reviewed (3 files in this increment)

.changeset/jetbrains-prune-old-cli.md
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt

Previous Review Summaries (4 snapshots, latest commit 33ddc72)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `33ddc72`)

Status: No Issues Found | Recommendation: Merge

The previously flagged SUGGESTION (cache-hit path re-hashing the entire archive on every resolve()) is fixed: warm-cache resolves now trust the verified .complete digest marker written after a successful download+verify+extract, avoiding the redundant re-hash. This increment also adds GitHub API rate-limit detection/logging to both the runtime downloader and the build-time OpenAPI spec task, threads a GH_TOKEN/GITHUB_TOKEN into the build-time metadata fetch, updates the release workflow/docs to match runtime CLI downloads, and adds a test covering the rate-limit error path. No new issues found in the changed code.

Files Reviewed (10 files in this increment)

.github/workflows/publish-jetbrains.yml
.kilo/skills/release-jetbrains/SKILL.md
CONTRIBUTING.md
packages/kilo-docs/pages/contributing/architecture/jetbrains-plugin.md
packages/kilo-jetbrains/AGENTS.md
packages/kilo-jetbrains/RELEASING.md
packages/kilo-jetbrains/backend/build.gradle.kts
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt
packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt

Previous review (commit `a435bae`)

Status: 1 Issue Found | Recommendation: Address before merge

All 12 previously reported issues in this PR have been verified as fixed in the latest commit (SHA-256 digest verification against GitHub release asset metadata added to both the runtime and build-time CLI downloaders, deleteRecursively() failures now surfaced, awaitReady() timeout raised to 120s, nullable session timestamps now logged with an explicit fallback, nullable profile balance/credit fields now hidden instead of coerced to 0.0, the stale CLI-version-label path was removed, package.json read is now a tracked configuration-cache input, download timeouts configured, changeset reworded to be user-facing, and the test-compile-breaking local val rename). One new item surfaced from the fix itself.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
`KiloCliDownloader.kt`	49	New cache-hit path re-hashes the entire archive with SHA-256 on every `resolve()` call, adding latency to every connect even when the cache is already trusted

Files Reviewed (11 files in this increment)

.changeset/jetbrains-download-cli.md
packages/kilo-jetbrains/backend/build.gradle.kts
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendAppService.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendSessionManager.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/rpc/KiloAppRpcApiImpl.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloBackendAppServiceTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/workspace/KiloBackendWorkspaceTest.kt
packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/app/KiloAppService.kt

Fix these issues in Kilo Cloud

Previous review (commit `891a7a5`)

Status: 12 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	8
SUGGESTION	3

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`KiloBackendAppServiceTest.kt`	145	Local `val ready` shadows the private `ready(svc)` helper, breaking compilation of the new download-progress test

WARNING

File	Line	Issue
`KiloCliDownloader.kt`	49	Downloaded CLI binary is chmod'd/trusted with no checksum/signature verification
`KiloCliDownloader.kt`	31	`deleteRecursively()` return value discarded; partial failures go unnoticed
`KiloBackendAppService.kt`	239	`awaitReady()` waits through `Downloading` but keeps the same 5s default timeout
`KiloBackendSessionManager.kt`	295	Nullable session timestamps silently default to epoch `0.0`
`KiloAppRpcApiImpl.kt`	155	Nullable profile balance/credit fields silently coerced to `0.0`
`SessionUi.kt`	506	CLI version label can remain stale/blank after restart or reinstall
`GenerateOpenApiSpecTask.kt`	77	Build-time CLI download also lacks checksum/signature verification
`backend/build.gradle.kts`	22	`package.json` version read isn't tracked as a configuration-cache input

SUGGESTION

File	Line	Issue
`KiloCliDownloader.kt`	17	Default `OkHttpClient()` timeouts may be too short for large downloads
`EmptySessionPanel.kt`	174	`setCliVersion` repaints even on no-op updates
`.changeset/jetbrains-download-cli.md`	5	Wording reads as an implementation summary rather than a user-facing benefit

Files Reviewed (44 files)

.changeset/jetbrains-download-cli.md
packages/kilo-jetbrains/.gitignore
packages/kilo-jetbrains/AGENTS.md
packages/kilo-jetbrains/README.md
packages/kilo-jetbrains/backend/build.gradle.kts - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloAppState.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendAppService.kt - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendConnectionService.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendSessionManager.kt - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/CliServer.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt - 3 issues
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliPlatform.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloProps.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/rpc/KiloAppRpcApiImpl.kt - 1 issue
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloAppStateTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloBackendAppServiceTest.kt - 1 issue
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloConnectionServiceTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/testing/FakeCliServer.kt
packages/kilo-jetbrains/build-tasks/build.gradle.kts
packages/kilo-jetbrains/build-tasks/src/main/kotlin/BuildTasksPlugin.kt
packages/kilo-jetbrains/build-tasks/src/main/kotlin/CheckCliTask.kt (deleted)
packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt - 1 issue
packages/kilo-jetbrains/build-tasks/src/main/kotlin/PrepareLocalCliTask.kt (deleted)
packages/kilo-jetbrains/build.gradle.kts
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/app/KiloAppService.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/SessionUi.kt - 1 issue
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/controller/SessionController.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/controller/SessionControllerEvent.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/ConnectionPanel.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/empty/EmptySessionPanel.kt - 1 issue
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/settings/profile/LoggedOutProfileUi.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/settings/profile/ProfileUi.kt
packages/kilo-jetbrains/frontend/src/main/resources/messages/KiloBundle.properties
packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/session/ui/ConnectionPanelTest.kt
packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/session/ui/EmptySessionPanelTest.kt
packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/testing/FakeAppRpcApi.kt
packages/kilo-jetbrains/gradle/libs.versions.toml
packages/kilo-jetbrains/script/build-version.sh
packages/kilo-jetbrains/script/build.ts
packages/kilo-jetbrains/shared/src/main/kotlin/ai/kilocode/rpc/KiloAppRpcApi.kt
packages/kilo-jetbrains/shared/src/main/kotlin/ai/kilocode/rpc/dto/KiloAppStateDto.kt

Fix these issues in Kilo Cloud

Previous review (commit `2746e69`)

Status: 12 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	8
SUGGESTION	3

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`KiloBackendAppServiceTest.kt`	145	Local `val ready` shadows the private `ready(svc)` helper, breaking compilation of the new download-progress test

WARNING

File	Line	Issue
`KiloCliDownloader.kt`	49	Downloaded CLI binary is chmod'd/trusted with no checksum/signature verification
`KiloCliDownloader.kt`	31	`deleteRecursively()` return value discarded; partial failures go unnoticed
`KiloBackendAppService.kt`	239	`awaitReady()` waits through `Downloading` but keeps the same 5s default timeout
`KiloBackendSessionManager.kt`	295	Nullable session timestamps silently default to epoch `0.0`
`KiloAppRpcApiImpl.kt`	155	Nullable profile balance/credit fields silently coerced to `0.0`
`SessionUi.kt`	506	CLI version label can remain stale/blank after restart or reinstall
`GenerateOpenApiSpecTask.kt`	77	Build-time CLI download also lacks checksum/signature verification
`backend/build.gradle.kts`	22	`package.json` version read isn't tracked as a configuration-cache input

SUGGESTION

File	Line	Issue
`KiloCliDownloader.kt`	17	Default `OkHttpClient()` timeouts may be too short for large downloads
`EmptySessionPanel.kt`	174	`setCliVersion` repaints even on no-op updates
`.changeset/jetbrains-download-cli.md`	5	Wording reads as an implementation summary rather than a user-facing benefit

Files Reviewed (44 files)

.changeset/jetbrains-download-cli.md
packages/kilo-jetbrains/.gitignore
packages/kilo-jetbrains/AGENTS.md
packages/kilo-jetbrains/README.md
packages/kilo-jetbrains/backend/build.gradle.kts - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloAppState.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendAppService.kt - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendConnectionService.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/app/KiloBackendSessionManager.kt - 1 issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/CliServer.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt - 3 issues
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliPlatform.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloProps.kt
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/rpc/KiloAppRpcApiImpl.kt - 1 issue
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloAppStateTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloBackendAppServiceTest.kt - 1 issue
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/app/KiloConnectionServiceTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt
packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/testing/FakeCliServer.kt
packages/kilo-jetbrains/build-tasks/build.gradle.kts
packages/kilo-jetbrains/build-tasks/src/main/kotlin/BuildTasksPlugin.kt
packages/kilo-jetbrains/build-tasks/src/main/kotlin/CheckCliTask.kt (deleted)
packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt - 1 issue
packages/kilo-jetbrains/build-tasks/src/main/kotlin/PrepareLocalCliTask.kt (deleted)
packages/kilo-jetbrains/build.gradle.kts
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/app/KiloAppService.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/SessionUi.kt - 1 issue
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/controller/SessionController.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/controller/SessionControllerEvent.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/ConnectionPanel.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/empty/EmptySessionPanel.kt - 1 issue
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/settings/profile/LoggedOutProfileUi.kt
packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/settings/profile/ProfileUi.kt
packages/kilo-jetbrains/frontend/src/main/resources/messages/KiloBundle.properties
packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/session/ui/ConnectionPanelTest.kt
packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/session/ui/EmptySessionPanelTest.kt
packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/testing/FakeAppRpcApi.kt
packages/kilo-jetbrains/gradle/libs.versions.toml
packages/kilo-jetbrains/script/build-version.sh
packages/kilo-jetbrains/script/build.ts
packages/kilo-jetbrains/shared/src/main/kotlin/ai/kilocode/rpc/KiloAppRpcApi.kt
packages/kilo-jetbrains/shared/src/main/kotlin/ai/kilocode/rpc/dto/KiloAppStateDto.kt

Fix these issues in Kilo Cloud

_{Reviewed by claude-sonnet-5-20260630 · Input: 42 · Output: 13.6K · Cached: 1.4M}

_{Review guidance: REVIEW.md from base branch main}

Each pinned CLI version was cached under the IDE system dir forever, so old versions accumulated across plugin updates. After a version resolves successfully, delete every other cached version and drop the downloaded archive after extraction. Reinstall still deletes and re-downloads the active version.

The collapsed metadata lookup threw a misleading "did not include" error whether the asset was absent, had no digest, or had a malformed digest. Split into distinct, logged messages so the actual cause is clear, including the nullable-digest case where GitHub has not published a checksum.

feat(jetbrains): download pinned Kilo Core releases at runtime

feat(jetbrains): download CLI releases at runtime

2746e69

kilo-code-bot Bot reviewed Jul 6, 2026

View reviewed changes

kirillk added 2 commits July 6, 2026 15:44

feat(jetbrains): show Core runtime info

891a7a5

fix(jetbrains): address runtime CLI review feedback

a435bae

kilo-code-bot Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt Outdated

kirillk added 2 commits July 6, 2026 16:58

fix(jetbrains): align runtime CLI download release flow

4fff14d

fix(jetbrains): avoid hashing cached CLI archive

33ddc72

kirillk changed the title ~~feat(jetbrains): download CLI releases at runtime~~ feat(jetbrains): download pinned Kilo Core releases at runtime Jul 6, 2026

Merge branch 'main' into triangular-saturday

59fa03b

johnnyeric approved these changes Jul 7, 2026

View reviewed changes

kirillk added 2 commits July 7, 2026 08:49

kirillk merged commit 5abae8e into main Jul 7, 2026
30 checks passed

kirillk deleted the triangular-saturday branch July 7, 2026 13:23

This was referenced Jul 7, 2026

release(jetbrains): v7.0.2-rc.1 #12011

Merged

release(jetbrains): v7.0.2 #12020

Merged

t7tran pushed a commit to t7tran/kilocode that referenced this pull request Aug 14, 2026

Merge pull request Kilo-Org#11975 from Kilo-Org/triangular-saturday

6904c00

feat(jetbrains): download pinned Kilo Core releases at runtime

Uh oh!

Conversation

kirillk commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Validation

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

Previous review (commit 33ddc72)

Previous review (commit a435bae)

Overview

SUGGESTION

Previous review (commit 891a7a5)

Overview

CRITICAL

WARNING

SUGGESTION

Previous review (commit 2746e69)

Overview

CRITICAL

WARNING

SUGGESTION

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kirillk commented Jul 6, 2026 •

edited

Loading

kilo-code-bot Bot commented Jul 6, 2026 •

edited

Loading

Previous review (commit `33ddc72`)

Previous review (commit `a435bae`)

Previous review (commit `891a7a5`)

Previous review (commit `2746e69`)