feat(jetbrains): add repo CLI dev mode

[kirillk]

Summary

• Add a dev-only JetBrains kilo.cli.pinned=false repo CLI mode that generates the OpenAPI client from local repo source and stages the locally built CLI into backend resources.
• Keep the default pinned release flow unchanged for normal JetBrains builds and runtime downloads.
• Add release checks and helper scripts to inspect, bump, test, and land JetBrains CLI pin changes deliberately.
• Add CLI release follow-up automation that opens a labeled JetBrains CLI pin bump PR after stable CLI releases.

Why

JetBrains releases need to move independently from the CLI while still benefiting from the monorepo. A pinned CLI version lets us cut JetBrains-specific releases from a known, published CLI without accidentally taking unreleased or untested CLI/runtime changes. An unpinned repo mode lets us test cross-system work locally when the JetBrains plugin, generated SDK, and CLI/server need to evolve together.

This gives maintainers explicit options instead of one implicit coupling:

• Pin to a released CLI when preparing a JetBrains-only release.
• Unpin locally when developing or validating changes that span JetBrains and the CLI.
• Keep production/release workflows deterministic by rejecting repo CLI mode in release builds.

Scenarios

JetBrains-Specific Release

Use the pinned default (kilo.cli.pinned=true) when releasing only JetBrains changes, such as IDE UI, split-mode integration, lifecycle fixes, or Marketplace packaging updates. The plugin downloads the published CLI version from packages/kilo-jetbrains/package.json, and release checks verify that the pinned CLI release/assets exist before tagging.

Ask the agent:

Release next JetBrains RC.

Cross-System Feature Work

Use repo CLI mode (kilo.cli.pinned=false) for local development when a feature needs coordinated changes across the JetBrains plugin and the CLI/server API. In this mode OpenAPI generation runs from local packages/opencode/, and the local CLI build is bundled into backend resources for runtime testing.

Ask the agent:

Test JetBrains with local repo CLI.

OpenCode Merge Validation

Use repo CLI mode to validate upstream/OpenCode merge work that may affect generated API types, server routes, process behavior, or bundled CLI assets before a CLI release exists. This makes it possible to test the JetBrains plugin against the merged repo state without publishing a temporary CLI.

Ask the agent:

Validate JetBrains against this OpenCode merge.

Returning To Release Mode

Before publishing or preparing a JetBrains release, restore kilo.cli.pinned=true. Gradle production builds, release scripts, and the JetBrains release skill reject repo CLI mode so local test binaries cannot be shipped accidentally.

Ask the agent:

Re-pin JetBrains for release.

CLI Release Follow-Up

Stable CLI releases now leave the JetBrains CLI pin as a reviewed follow-up instead of silently changing it in the CLI release commit. After the CLI publish flow completes, it attempts to open or update a PR that bumps packages/kilo-jetbrains/package.json to the newly released CLI version.

That follow-up PR:

• Is labeled jetbrains-cli-pin-bump.
• Logs its URL in the CLI release workflow when creation succeeds.
• Logs a warning and does not fail the main CLI release if PR creation fails.
• Gives maintainers a review/test point before the JetBrains release skill locks the new CLI pin into an immutable jetbrains/v* tag.

Notes

• Repo mode intentionally fails when the local CLI binary is missing and points developers at :backend:buildRepoCli instead of auto-building.
• The staged runtime bundle includes the full local CLI bin/ directory so tree-sitter assets, console files, sandbox workers, and Linux bwrap stay available.

Release Analysis

• Reviewed the stable CLI pin-bump PR timing, repo CLI dev mode, and existing pinned JetBrains release flow. Assets are published before the follow-up PR runs, release gates block repo mode, and the default pinned path remains unchanged.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge (non-blocking)

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt	53	Zip-slip-safe write() still duplicates GenerateOpenApiSpecTask.write() almost line-for-line (author has explained the intentional split between build-tooling and runtime classpaths)

Resolved since last review (incremental diff at this commit):

• script/jetbrains-release-pr.ts — pinned() now splits on = and trims the key, so kilo.cli.pinned = false (with whitespace around =) is detected correctly instead of silently falling back to pinned, matching the same fix already applied in check-pin.ts.
• script/jetbrains-release-validate.ts — same pinned() whitespace-tolerant fix applied for consistency with the release-gate semantics.

No new issues found in the incremental diff (script/jetbrains-release-pr.ts, script/jetbrains-release-validate.ts).

Files Reviewed (19 files)

• .github/workflows/publish.yml
• .kilo/skills/release-jetbrains/SKILL.md
• .kilo/skills/release-jetbrains/script/check-pin.ts
• .kilo/skills/release-jetbrains/script/pin-common.ts
• .kilo/skills/release-jetbrains/script/set-pin.ts
• packages/kilo-jetbrains/AGENTS.md
• packages/kilo-jetbrains/RELEASING.md
• packages/kilo-jetbrains/backend/build.gradle.kts
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloProps.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt - 1 issue
• packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloRepoCliTest.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/StageRepoCliTask.kt
• packages/kilo-jetbrains/build.gradle.kts
• packages/kilo-jetbrains/gradle.properties
• packages/kilo-jetbrains/script/build-version.sh
• script/jetbrains-release-pr.ts
• script/jetbrains-release-validate.ts
• script/publish.ts

Fix these issues in Kilo Cloud

Previous Review Summaries (3 snapshots, latest commit 86a02bf)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 86a02bf)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt	53	Zip-slip-safe write() still duplicates GenerateOpenApiSpecTask.write() almost line-for-line

Resolved since previous review:

• KiloBackendCliManager.kt — repo-CLI extraction now runs inside withContext(Dispatchers.IO) and onProgress(100) is reported only after extraction succeeds.
• packages/kilo-jetbrains/script/build-version.sh — release gate regex now tolerates whitespace around =, matching the actual property parsing.
• .kilo/skills/release-jetbrains/script/check-pin.ts — pinned() now trims and splits on = instead of a literal prefix match, so whitespace around = no longer causes a silent false-positive pin.
• .kilo/skills/release-jetbrains/script/set-pin.ts — asset, missing(), and latest() were extracted into the new shared pin-common.ts, removing the duplication with check-pin.ts.

Files Reviewed (19 files)

• .github/workflows/publish.yml
• .kilo/skills/release-jetbrains/SKILL.md
• .kilo/skills/release-jetbrains/script/check-pin.ts
• .kilo/skills/release-jetbrains/script/pin-common.ts
• .kilo/skills/release-jetbrains/script/set-pin.ts
• packages/kilo-jetbrains/AGENTS.md
• packages/kilo-jetbrains/RELEASING.md
• packages/kilo-jetbrains/backend/build.gradle.kts
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloProps.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt
• packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloRepoCliTest.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/StageRepoCliTask.kt
• packages/kilo-jetbrains/build.gradle.kts
• packages/kilo-jetbrains/gradle.properties
• packages/kilo-jetbrains/script/build-version.sh
• script/jetbrains-release-pr.ts
• script/jetbrains-release-validate.ts
• script/publish.ts

Fix these issues in Kilo Cloud

Previous review (commit 616012e)

Status: 5 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	4

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt	93	Repo-CLI extraction runs blocking I/O without Dispatchers.IO, and reports 100% progress before extraction runs

SUGGESTION

File	Line	Issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt	51	Zip-slip-safe write() duplicates GenerateOpenApiSpecTask.write() almost line-for-line
packages/kilo-jetbrains/script/build-version.sh	89	Release gate regex is stricter than the actual property parsing it guards against
.kilo/skills/release-jetbrains/script/check-pin.ts	109	pinned() requires no whitespace around =, unlike the Gradle property reader it mirrors
.kilo/skills/release-jetbrains/script/set-pin.ts	125	asset, missing(), and latest() duplicate check-pin.ts almost line-for-line

Files Reviewed (17 files)

• .kilo/skills/release-jetbrains/SKILL.md
• .kilo/skills/release-jetbrains/script/check-pin.ts
• .kilo/skills/release-jetbrains/script/set-pin.ts
• packages/kilo-jetbrains/AGENTS.md
• packages/kilo-jetbrains/RELEASING.md
• packages/kilo-jetbrains/backend/build.gradle.kts
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloProps.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt
• packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloRepoCliTest.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/StageRepoCliTask.kt
• packages/kilo-jetbrains/build.gradle.kts
• packages/kilo-jetbrains/gradle.properties
• packages/kilo-jetbrains/script/build-version.sh
• script/jetbrains-release-pr.ts
• script/jetbrains-release-validate.ts

Fix these issues in Kilo Cloud

Previous review (commit 98d8d22)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt	93	Repo-CLI extraction runs blocking I/O without Dispatchers.IO, and reports 100% progress before extraction runs

SUGGESTION

File	Line	Issue
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt	51	Zip-slip-safe write() duplicates GenerateOpenApiSpecTask.write() almost line-for-line
packages/kilo-jetbrains/script/build-version.sh	89	Release gate regex is stricter than the actual property parsing it guards against

Files Reviewed (15 files)

• .kilo/skills/release-jetbrains/SKILL.md
• packages/kilo-jetbrains/AGENTS.md
• packages/kilo-jetbrains/RELEASING.md
• packages/kilo-jetbrains/backend/build.gradle.kts
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloBackendCliManager.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloProps.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloRepoCli.kt
• packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloRepoCliTest.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/GenerateOpenApiSpecTask.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/StageRepoCliTask.kt
• packages/kilo-jetbrains/build.gradle.kts
• packages/kilo-jetbrains/gradle.properties
• packages/kilo-jetbrains/script/build-version.sh
• script/jetbrains-release-pr.ts
• script/jetbrains-release-validate.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 26 · Output: 7.8K · Cached: 603.3K}

_{Review guidance: REVIEW.md from base branch main}