Kimi CLI
$
npx @buildinternet/releases get kimi-cliMon
Wed
Fri
SepOctNovDecJanFebMarAprMayJunJulAug
LessMore
Releases4Avg1/moVersionsv1.47.0 to v1.50.0
npx @buildinternet/releases get kimi-clianthropic-beta header when no beta features are declared — adaptive thinking removes the interleaved-thinking beta, which previously left an empty header value that some backends rejectHighlights: The completion-token budget for Kimi providers now adapts to the model's remaining context window, reducing context-length overflow errors on long turns
max_tokens=32000 but estimates the remaining context for each request and caps max_completion_tokens accordingly. Set the new KIMI_MODEL_MAX_COMPLETION_TOKENS env var for an explicit hard cap (KIMI_MODEL_MAX_TOKENS remains a compatibility alias; 0 or a negative value disables clamping)reasoning_effort parameter when configuring thinking — requests now use thinking.type exclusively while preserving explicit legacy passthroughreasoning_content from thinking models being dropped from history — a reply that reasoned but ended with empty reasoning was recorded as having no reasoning at all, so Preserved Thinking backends that require reasoning_content on every assistant message rejected the next request with a 400/upgrade command that installs it (migrating your config & sessions automatically), a welcome-screen nudge, and a once-per-day tip shown on exit/clear is now an alias for /new — both commands start a new session; previously /clear only cleared context without creating a new session/h, ?, and status now resolve to their canonical commands (/help, /usage); the completer and help output display alias matches as /name (alias) for clarity/usage alias registration — the alias was incorrectly stored as "/status" instead of "status", causing alias lookup to failfinished_at and duration_s to the notification payload for easier tracking~/.kimi/mcp-oauth/ using FastMCP 3's persistent storage API; users with existing OAuth MCP authorizations may need to run kimi mcp auth <name> once after upgradingbash.exe (POSIX semantics) instead of powershell.exe. Windows users get the same Unix-style command syntax (&&, ||, |, /dev/null, grep, sed, etc.) as Linux/macOS. Requires Git for Windows installed: kimi-cli locates bash.exe via the KIMI_CLI_GIT_BASH_PATH env override → where.exe git → standard install paths (C:\Program Files\Git\bin\bash.exe); if none resolve, kimi-cli prints an install hint and exits at startup2>nul redirects on Windows by rewriting them to 2>/dev/null before reaching git-bash — without this defense git-bash would create a file literally named nul (a Windows reserved device name) that breaks git add . and git clone; on Linux/macOS, >nul is a legitimate redirect to a file named nul and is left untouchedReadFile, WriteFile, StrReplaceFile, Glob, and Grep — these tools now recognize /c/Users/foo (Git Bash style), /cygdrive/c/Users/foo (Cygwin style), and \\server\share (UNC) in addition to native Windows paths, automatically converting to native form for filesystem operationsStepRetry event emitted when a step attempt fails and will be retried, carrying attempt count, wait time, and error detailsEnterPlanMode, ExitPlanMode, and AskUserQuestion. These prompt injections are now root-only. Tool-level read-only checks under plan mode are unchanged, so behavior compatibility is preserved.zip URL — kimi plugin install now accepts HTTP(S) URLs ending in .zip (e.g. GitHub/GitLab archive links like .../archive/refs/heads/main.zip) and downloads + extracts them before resolving plugin.json, in addition to the existing git URL, local directory, and local zip-file sources--yolo mode unintentionally preventing the model from calling AskUserQuestion — yolo used to inject a system reminder telling the model it was in "non-interactive mode" and must not ask, and the ask-user tool auto-dismissed in yolo. Both were wrong: yolo only bypasses permission approvals; it does not mean "the user is gone". Yolo no longer injects model guidance, and the user remains reachable through AskUserQuestion--yolo bypasses permission approvals while the user is still at the terminal, while --afk / /afk means away-from-keyboard: AskUserQuestion is auto-dismissed and approvals are handled automatically. --print now uses runtime AFK behavior instead of yolo, matching its non-interactive execution model. The status bar shows yolo and afk independently, and /yolo and /afk toggle their own flag without disturbing the otherskip_yolo_prompt_injection with skip_afk_prompt_injection now that yolo no longer injects model guidance. The old config key is ignored if present/yolo toggling producing misleading UI messages when afk is also active — /yolo used to read the combined auto-approval state, so pressing it under afk would claim approval was now required even though afk still handled approvals automatically. /yolo now reads and writes only the yolo flag, leaving afk alonetitle_generated flag set by another requeston_retryable_error now reads the current api_key from the live client instead of the cached _api_key, so that OAuth token refreshes applied via client.api_key are preserved when the client is rebuilt after a retryable errorRejected by user; active foreground and subagent approvals now wait indefinitely for user response/usage remaining quota rendering — the progress bar, warning colors, and % left label now all use the remaining quota ratio consistently, so high remaining quota shows as green/full and near-exhausted quota shows as yellow or red⚙ bash: N badge only counted background Shell tasks and filtered out background Agent subagents, so when many subagents were running the prompt looked idle and users could not tell work was in progress; the toolbar now renders ⚙ bash: N and ⚙ agent: N as two independent badges (each hidden when its count is 0) and drops the agent badge first when the terminal is too narrow to fit both/models sync now detects 401 responses, forces an OAuth token refresh, and retries with the refreshed token; if the refresh fails or the refreshed token is still rejected, it falls back to the originally configured static API key instead of skipping the providerAPIConnectionError or APITimeoutError, the retry now re-enters the full recovery path so a subsequent 401 correctly refreshes the OAuth token instead of bubbling to the user as an unrecoverable error/skill:* and /flow:* inputs in the transcript so workflow commands stay visible after enter; operational slash commands like /usage and /model remain hiddenmax_steps_per_turn from 500 to 1000 so long-running agents are less likely to hit the per-turn limit### Project / ### User / ### Extra / ### Built-in headings so the model can tell where each skill came from, and when the same name exists in multiple scopes the more specific scope wins (Project > User > Extra > Built-in) so a project's own .kimi/skills/foo or .claude/skills/foo correctly overrides a user-level or bundled foo instead of the other way around<name>.md skills alongside the canonical <name>/SKILL.md subdirectory layout — useful when migrating a flat markdown collection into a skills directory; name defaults to the filename stem (frontmatter name: still wins if set), description follows the same three-step chain as subdirectory skills (frontmatter description: → first non-empty body line, capped at 240 characters → "No description provided." placeholder), and if a flat and a subdirectory skill share a name in the same directory the subdirectory wins with a warningextra_skill_dirs config field for pulling in custom skill directories on top of the built-in / user / project auto-discovery — each entry may be an absolute path, a ~-prefixed path (expanded against $HOME), or a path relative to the project root (the nearest .git ancestor of the work directory, not the current working directory); non-existent entries are silently skipped and symlink/trailing-slash duplicates canonicalize to a single root so a path listed twice or aliased to an already-discovered directory does not render twice in the system promptOSError from is_dir / iterdir (for example when an extra_skill_dirs entry points at a directory with restricted permissions) — affected entries are logged and skipped instead of aborting the whole skill-discovery passThe reasoning_content in the thinking mode must be passed back to the API when a tool call follows a reasoning turn — openai_legacy providers now default reasoning_key to "reasoning_content" so the response's reasoning is stored in history and round-tripped automatically on subsequent turns. An optional reasoning_key field is also added to LLMProvider to override the field name (e.g. "reasoning" for non-standard gateways) or disable round-tripping entirely by setting it to ""skip_yolo_prompt_injection config option to suppress the system reminder normally injected when yolo mode is active — useful when building custom applications on top of KimiSoul that do not need the non-interactive mode hintKIMI_MODEL_THINKING_KEEP environment variable that forwards its value verbatim to the Moonshot API as thinking.keep, enabling Preserved Thinking (e.g. export KIMI_MODEL_THINKING_KEEP=all to retain historical reasoning_content across turns); effective only for Moonshot models supporting Preserved Thinking (e.g. kimi-k2.6 / kimi-k2-thinking), unset or empty string preserves the previous behavior and omits the field, and the override only applies when the current model is actually in thinking mode so the API never receives a thinking.keep without the companion thinking.type. Note that keep=all increases input tokens and API cost because history reasoning is resentKimi.with_extra_body silently dropping previously set thinking.type when a later call added another thinking.* field — the thinking sub-dict is now merged field-by-field instead of shallow-replaced, so composing with_thinking(...) with with_extra_body({"thinking": {...}}) preserves both contributionscontent alongside tool_calls, which caused 400 "text content is empty" errors from the Moonshot API. When an assistant message has tool calls and its visible content is effectively empty (no text or only whitespace/think parts), the content field is now omitted entirelyAt path 'properties.X': type is not defined when an MCP server exposes tools whose parameter schemas have enum-only or otherwise type-less properties (seen with the JetBrains Rider MCP's truncateMode) — the Kimi provider now patches each tool's schema in-flight to fill in a JSON Schema type (inferred from enum/const values when possible, else defaulted to "string"), so the whole session no longer fails every request with a schema validation error; OpenAI and Anthropic paths are unaffected.git ancestor before looking for .kimi/skills / .claude/skills / .codex/skills / .agents/skills, so skills defined at the repository root are picked up even when kimi-cli is launched from a subdirectory (for example inside a monorepo package). Falls back to the work directory itself when no .git marker is found, so we never walk up into an unrelated parent tree.merge_all_available_skills from false to true. kimi-cli now merges all existing user- and project-level brand skill directories (.kimi/skills, .claude/skills, .codex/skills) by default instead of only using the first one found, so users who keep skills in multiple brand directories — for example both ~/.kimi/skills and ~/.claude/skills — see every skill out of the box. Behavior change: users who previously relied on the first-match default can restore it by setting merge_all_available_skills = false in their config.Rejected by user misleading message when an approval modal times out — after the 300s safety timeout, the tool call now rejects with Rejected: approval timed out, so users returning to their session after stepping away can tell the rejection was a timeout rather than a manual rejection. Pass --yolo/-y to auto-approve tool calls if you regularly leave sessions unattended/login again after an unrelated refresh-token rotation race — when a concurrently-running kimi-cli instance (terminal, VS Code extension, or kimi -p one-shot) legitimately rotated the refresh token, the current instance's now-stale refresh request would come back with a 401, and a TOCTOU window between the "did another instance rotate?" disk check and the delete_tokens call could wipe the credentials file even though a valid rotated token was about to be written to it; the in-memory cache is still cleared so truly revoked tokens surface on the next request, but the file is preserved so a concurrent instance's freshly-rotated token can be recovered, and an eventual /login still overwrites it atomicallytool_use blocks in an assistant turn must be answered within one user message; this fixes 400 errors on strict Anthropic-compatible backends (e.g. DeepSeek /anthropic endpoint) and prevents the official backend from silently teaching the model to avoid parallel tool calls--print mode, the process now waits for running background agents to finish and lets the model process their results, instead of exiting and killing them. The wait is capped at min(max(active_task.timeout_s or agent_task_timeout_s), print_wait_ceiling_s) (default ceiling 1h); on timeout the tasks are killed and the model gets one more turn via a <system-reminder> to summarise before exitkeep_alive_on_exit=true still skips the entire path/models endpoint as a background task when the shell launches, so newly released models become available without needing to log out and log back in; failures are silent and never block startup, and custom --config sessions keep their previous behaviordisplay_name (e.g. k2.6-code-preview) for managed models across the welcome panel, prompt status bar, /model picker, and /model switch confirmation messages; when the backend does not return one, the CLI falls back to the internal model ID as beforeinvalid_request_error — Opus 4.7 (which rejects the legacy {type: "enabled", budget_tokens: N} thinking config) now correctly uses adaptive thinking, and the client explicitly sets display: "summarized" so thinking content still streams back (Opus 4.7 silently changed the default to "omitted"); Bedrock/Vertex name variants (e.g., aws/claude-opus-4-7, anthropic.claude-opus-4-7-v1:0) and claude-mythos-preview are also recognised, and future Claude versions ≥ 4.6 are detected automatically via version extrapolation instead of hard-coded substring matchingmax_steps_per_turn from 100 to 500 to allow longer uninterrupted agent runs out of the boxshow_thinking_stream default to true so fresh installs see the streaming reasoning preview out of the box; set it to false in your config to keep the compact 1.32 indicatorINTERNAL_ERROR, allowing the session to recover instead of hanging indefinitelyTaskStop — stopping a stuck background agent no longer prints Unhandled exception in event loop / Exception None and freezes the terminal; the cancelled task is now kept in the manager's live-tasks dict until its runner finishes cleaning up, preventing Python's GC from reaping the still-pending taskshow_thinking_stream config option to opt back into the legacy streaming reasoning preview — when set to true, the live area shows the classic Thinking... spinner above a 6-line scrolling preview of the raw reasoning text and the full reasoning markdown is committed to history when the block ends; defaults to false to keep the compact 1.32 indicatorkimi-k2.5 version references from the welcome screen and /login tipkimi info, kimi export, kimi mcp, kimi plugin, kimi vis, and kimi web now work correctly in the standalone binary distributionThinking label with animated dots, elapsed time, token count, and a live tokens/second pulse; finalises with a Thought for Xs · N tokens trace in historylist_directory output as a depth-limited tree to prevent token-limit blowup in large directories — replaces the unbounded flat listing with a 2-level tree (root: 30 entries, child: 10 per subdirectory), dirs-first alphabetical sorting, and "... and N more" truncation hints so the model knows to explore further (fixes #1809)[Enter] to upgrade immediately, [q] to continue and be reminded next time, or [s] to skip reminders for that version; respects the KIMI_CLI_NO_AUTO_UPDATE environment variable; replaces the previous repeating toast notification for available updates/login; multiple simultaneous CLI instances coordinate refresh via a cross-process file lock to avoid race conditions; token persistence uses atomic writes with fsync to prevent corruption; adds dynamic refresh threshold, 5xx retry during token refresh, and proper token revocation cleanupAPIError (instead of APIConnectionError) during long-running streams, the error is now correctly classified as retryable, enabling automatic retry and connection recovery instead of an unrecoverable crash/sessions picker — completely empty sessions (no conversation history and no custom title) are no longer shown in the session list; sessions with a custom title are still displayed@) accept without submitting so the user can continue editing; re-completion after accepting is suppressed to prevent stale completion state/sessions picker — press Ctrl+A to switch between showing sessions for the current working directory only or across all known directories; uses a new full-screen session picker UI with header scope indicator and footer hint bar/btw side question command — ask a quick question during streaming without interrupting the main conversation; uses the same system prompt and tool definitions for prompt cache alignment; responses display in a scrollable modal panel with streaming supportvisualize.py (1865 lines) into a modular package (visualize/) with dedicated modules for input routing, interactive prompts, approval/question panels, and btw modal; unify input semantics with classify_input() for consistent command routingBtwBegin/BtwEnd wire events for cross-client side question support"1m 23s" instead of "83s"; sub-second durations show "<1s"[/] characters are now escaped to prevent broken rendering or style injection in spinner text and panel titleskimi export archives, and surface actionable error messages for common failures (auth, network, timeout, quota)git ls-files for @ file mention discovery — file completer now queries git ls-files --recurse-submodules with a 5-second timeout as the primary discovery mechanism, falling back to os.walk for non-git repositories; this fixes large repositories (e.g., apache/superset with 65k+ files) where the 1000-file limit caused late-alphabetical directories to be unreachable (fixes #1375)file_filter module — unifies file mention logic between shell and web UIs via src/kimi_cli/utils/file_filter.py, providing consistent path filtering, ignored directory exclusion, and git-aware file discoveryscope parameter in file completer requests is now validated to prevent directory traversal attackstodos to read current state) and clear mode (pass []); includes anti-storm guidance in tool description to prevent repeated calls without progress (fixes #1710)line_offset for tail mode — the tool now reports Total lines in file: N. in its message so the model can plan subsequent reads; negative line_offset (e.g. -100) reads the last N lines using a sliding window, useful for viewing recent log output without shell commands; the absolute value is capped at 1000 (MAX_LINES)NEUTRAL_MARKDOWN_THEME now overrides all Rich default markdown.* styles to "none", preventing Rich's built-in "cyan on black" from leaking through on non-black terminalsTurnEnd is now emitted even when a turn exits via cancellation or step interruption, preventing dirty session wire logs from accumulating across resume cycles--continue/--resume now tolerate malformed context.jsonl records and corrupted subagent, background-task, or notification artifacts; the CLI skips invalid persisted state where possible instead of failing to restore the sessionkimi export session export UX — kimi export now previews the previous session for the current working directory and asks for confirmation, showing the session ID, title, and last user-message time; adds --yes to skip confirmation; also fixes explicit session-ID invocations where --output after the argument was incorrectly parsed as a subcommandinclude_ignored parameter to search files excluded by .gitignore — when set to true, ripgrep's --no-ignore flag is enabled, allowing searches in gitignored artifacts such as build outputs or node_modules; sensitive files (like .env) remain filtered by the sensitive-file protection layer; defaults to false to preserve existing behavior.env, SSH private keys (id_rsa, id_ed25519, id_ecdsa), and cloud credentials (.aws/credentials, .gcp/credentials) are now detected and blocked; Grep filters them from results with a warning, Read rejects them outright; .env.example/.env.sample/.env.template are exempted_set_active_approval_sink no longer flushes pending approval requests to the live view sink (which cannot render approval modals); requests stay in the pending queue for the prompt modal path; also adds a 300-second timeout to wait_for_response so that any unresolved approval request eventually raises ApprovalCancelledError instead of hanging forever--session/--resume (-S/-r) flag to resume sessions — without an argument opens an interactive session picker (shell UI only); with a session ID resumes that specific session; replaces the reverted --pick-session/--list-sessions design with a unified optional-value flagshorten() utility — replaces all textwrap.shorten calls so that CJK text without spaces is truncated gracefully instead of collapsing to just the placeholder~/.kimi/skills/) silently disappearing when a generic directory (~/.config/agents/skills/) exists but is empty — skill directory discovery now searches brand and generic directory groups independently and merges both results, instead of stopping at the first existing directory across all candidatesmerge_all_available_skills config option — when enabled, skills from all existing brand directories (~/.kimi/skills/, ~/.claude/skills/, ~/.codex/skills/) are loaded and merged instead of using only the first one found; same-name skills follow priority order kimi > claude > codex; disabled by default--plan flag and default_plan_mode config option — start new sessions in plan mode via kimi --plan or by setting default_plan_mode = true in ~/.kimi/config.toml; resumed sessions preserve their existing plan mode state/undo and /fork commands for session forking — /undo lets you pick a previous turn and fork a new session with the selected message pre-filled for re-editing; /fork duplicates the entire session history into a new session; the original session is always preserved-r as a short alias for --session and print a resume hint (kimi -r <session-id>) whenever a session exits — covers normal exit, Ctrl-C, /undo, /fork, and /sessions switch so users can always find their way backcustom_headers not being passed to non-Kimi providers — OpenAI, Anthropic, Google GenAI, and Vertex AI providers now correctly forward custom headers configured in providers.*.custom_headersAGENTS.md loading — the CLI now discovers and merges AGENTS.md files from the git project root down to the working directory, including .kimi/AGENTS.md at each level; deeper files take priority under a 32 KiB budget cap, ensuring the most specific instructions are never truncatedKIMI_CLI_PASTE_CHAR_THRESHOLD and KIMI_CLI_PASTE_LINE_THRESHOLD environment variables to control when pasted text is folded into a placeholder — lowering these thresholds works around CJK input method breakage after multiline paste on some terminals (e.g., XShell over SSH)render_to_ansi no longer hardcodes 24-bit color; Rich now auto-detects terminal capability via COLORTERM/TERM environment variablesindex.html — the server now returns Cache-Control: no-cache for HTML and immutable for hashed assets, preventing 404s on renamed chunkswritetext now opens files with newline="" to prevent Python's universal newline translation from silently converting \n to \r\nsocks:// proxy scheme — proxy tools like V2RayN set ALL_PROXY=socks://... which httpx/aiohttp don't recognise; the CLI now normalises socks:// to socks5:// at startup so all HTTP clients and subprocesses work correctly behind a SOCKS proxy/title (alias /rename) command to manually set session titles — titles are now stored in state.json alongside other session state; legacy metadata.json is automatically migrated on first loadMANPAGER is set (e.g. bat) — the console pager now ignores MANPAGER and delegates to pydoc.pager(), preserving PAGER and all platform-specific fallbacks8;id=391551;https://…) instead of clean text — hyperlink sequences are now wrapped as zero-width escapes for prompt_toolkit compatibility, preserving clickable links in supported terminalscommand parameter description saying "bash command" regardless of platform — the description is now platform-neutral