fix(jetbrains): avoid CLI checksum API rate limits

[kirillk]

Issue

No linked issue; this fixes a support-reported JetBrains plugin startup failure where shared/NAT IPs exhaust GitHub's unauthenticated API rate limit while resolving the pinned Kilo CLI checksum.

Context

The JetBrains plugin downloads the pinned CLI from GitHub Releases on first connect. The binary download itself is CDN-backed, but the plugin made a separate unauthenticated api.github.com release metadata call to read the asset SHA-256 digest before verification. Corporate/shared egress IPs can hit GitHub's 60 requests/hour unauthenticated API limit, blocking fresh installs and updates.

Implementation

• Generate a bundled kilo-cli-checksums.properties resource at build time for pinned, non-bundled JetBrains builds.
• Use the build-time GitHub metadata call with GH_TOKEN/GITHUB_TOKEN support to collect all platform asset digests.
• Load bundled checksums at runtime and verify downloaded archives against them without calling api.github.com.
• Keep the existing metadata lookup as a fallback if a platform checksum is missing or malformed.
• Cover the bundled-checksum, fallback, and mismatch paths in KiloCliDownloaderTest.

Screenshots / Video

N/A - backend download/build behavior only.

How to Test

Manual/local verification

• Agent ran ./gradlew :backend:test --tests ai.kilocode.backend.cli.KiloCliDownloaderTest from packages/kilo-jetbrains/.
• Agent ran ./gradlew typecheck from packages/kilo-jetbrains/.

Reviewer test steps

1. From packages/kilo-jetbrains/, run ./gradlew :backend:test --tests ai.kilocode.backend.cli.KiloCliDownloaderTest.
2. From packages/kilo-jetbrains/, run ./gradlew typecheck.
3. Inspect a pinned, non-bundled backend build and confirm kilo-cli-checksums.properties is included in backend resources.

Blocked checks and substitute verification

• None.

Checklist

• Issue linked above, or exception explained
• Tests/verification described
• Screenshots/video included for visual changes, or marked N/A
• Changeset considered for user-facing changes
• I personally reviewed the diff and can explain the changes, including any AI-assisted work.

Get in Touch

N/A

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Incremental review of f8197d869e: both previous suggestions are resolved — cross-reference comments now link WriteCliChecksumsTask.PLATFORMS, StageBundledCliTask.PLATFORMS, and KiloCliPlatform.current(), and the new falls back to github metadata when bundled checksum is malformed test covers the malformed-digest fallback branch, asserting the exact WARN message and the metadata-then-download request order against the real implementation. No new issues found.

Files Reviewed (3 files)

• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliPlatform.kt
• packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/WriteCliChecksumsTask.kt

Previous Review Summary (commit a957cc3)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit a957cc3)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	2

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/kilo-jetbrains/build-tasks/src/main/kotlin/WriteCliChecksumsTask.kt	23	PLATFORMS list duplicates KiloCliPlatform's platform universe across modules with no cross-reference; adding a platform there silently loses the bundled-checksum optimization
packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt	209	Malformed-bundled-checksum fallback branch in digest() has no test coverage; the other three paths are tested

The change is well-scoped: checksums are generated at build time with the same GH_TOKEN/GITHUB_TOKEN pattern GenerateOpenApiSpecTask already uses, the runtime version provably matches the build-time pin (both derive from pinnedCliVersion), the fallback to the GitHub metadata API preserves prior behavior when the resource or platform entry is absent, and no token material reaches logs. No memory-leak concerns: the new lazy resource load is a one-time cached read and all connections/streams are closed.

Fix these issues in Kilo Cloud

Files Reviewed (7 files)

• .changeset/jetbrains-cli-checksums.md
• packages/kilo-jetbrains/backend/build.gradle.kts
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliChecksums.kt
• packages/kilo-jetbrains/backend/src/main/kotlin/ai/kilocode/backend/cli/KiloCliDownloader.kt - 1 issue
• packages/kilo-jetbrains/backend/src/test/kotlin/ai/kilocode/backend/cli/KiloCliDownloaderTest.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/BuildTasksPlugin.kt
• packages/kilo-jetbrains/build-tasks/src/main/kotlin/WriteCliChecksumsTask.kt - 1 issue

---

_{Reviewed by kimi-k3 · Input: 103.9K · Output: 6K · Cached: 478.8K}

_{Review guidance: REVIEW.md from base branch main}