chore: convert upstream-manual-merge command to agent#9965
Merged
Conversation
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (1 files)
Reviewed by gpt-5.5-2026-04-23 · 254,232 tokens |
Three new/extended sections capturing patterns that repeatedly caught us off-guard during the v1.14.33 merge: - 6.5 Scan auto-merged files for latent bugs. Not every problem surfaces as a conflict marker: duplicate declarations, duplicate manifest keys, orphaned imports, and partially-applied auto-merges that reference names from paths Kilo stubbed out. - 9.5 Handle downstream API renames as separate commits. An upstream rename auto-merges cleanly in shared code but cascades into Kilo-only files. Keep the behavioural merge commit focused; land the mechanical cascade in follow-ups. - 9.6 Handle upstream-added tests that diverge from Kilo. Upstream tests can encode contracts Kilo intentionally breaks, intercept seams that dependency injection now bypasses, or assume serialization shapes Kilo's extensions violate. Rewrite, skip, or delete — with a kilocode_change breadcrumb. - Common pitfalls: added ambient-state / dependency-injection / serialization / rule-ordering / environment-divergence / lockfile-sync bullets, phrased generically so they apply beyond any one technology stack.
chrarnoldus
approved these changes
May 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converts
.kilo/command/upstream-manual-merge.mdinto.kilo/agent/upstream-merge.mdso the workflow can run under agent-scoped permissions. The body of the workflow is unchanged except for step 1, which no longer relies on$ARGUMENTS(agents don't support command template vars) — the agent reads the version from the user's first message, the branch name, or the newestupstream-merge-report-<version>.md.Why
The existing slash command ran under the caller's unrestricted permissions. As an agent we can gate
read,edit, andwebfetchbehindask, and whitelist only the read-only shell commands the workflow actually needs (git status/log/diff/show, grep/rg, cat/head/tail, gh pr view,script/upstream/find-conflict-markers.sh, the project's test/typecheck/lint runners, etc.) while leaving everything else — notablysed -iand any other file-mutating shell command — to fall through toask. This makes the "approve before applying" step of the manual merge workflow mechanical instead of social.Notes
permission/evaluate.ts:9-15usesArray.findLast), so"*": askis listed first and specific allows follow. Thekilo-configbuilt-in skill doc currently states the opposite — worth a follow-up fix there.*is special-cased so e.g."git status *"matches both baregit statusandgit status --short.