Kimi CLI Changelog File — Moonshot AI

Changelog

Unreleased

Shell: Show trailing output in tool error briefs when commands fail

1.46.0 (2026-05-28)

Shell: Support styled text in welcome tips
ACP: Replay session history on load
Core: Prevent TTY hang on exit
Core: Close MCP connections during shutdown

1.45.0 (2026-05-26)

Shell: /clear is now an alias for /new — both commands start a new session; previously /clear only cleared context without creating a new session
Shell: Fix misleading "Quota exceeded" prefix shown on every 403 error

1.44.0 (2026-05-13)

Shell: Add slash command alias resolution — aliases such as /h, ?, and status now resolve to their canonical commands (/help, /usage); the completer and help output display alias matches as /name (alias) for clarity
Shell: Fix /usage alias registration — the alias was incorrectly stored as "/status" instead of "status", causing alias lookup to fail

1.43.0 (2026-05-12)

Security: Bump pillow to 12.2.0 to address CVE-2026-25990 (out-of-bounds write when loading PSD images); unblocks installs in environments that gate on the older pinned version
Shell: Fix missing visual spacing in the shell UI — add blank lines after user input echoes, content blocks, tool call results, notifications, error panels, and steer inputs so consecutive elements no longer collapse together
Shell: Restore markdown link highlighting (bright blue underlined text and cyan underlined URLs) and add underline separators to h2-h6 headings; adjust table rendering to use square box borders with visible edges
Core: Include completion timestamp and elapsed duration in background task terminal notifications, and add finished_at and duration_s to the notification payload for easier tracking
MCP: Stop FastMCP OAuth startup from printing Authlib deprecation warnings by upgrading the MCP client stack to FastMCP 3.2.4
MCP: Store OAuth MCP tokens in ~/.kimi/mcp-oauth/ using FastMCP 3's persistent storage API; users with existing OAuth MCP authorizations may need to run kimi mcp auth <name> once after upgrading

1.42.0 (2026-05-11)

Shell: Switch the Windows shell backend from PowerShell to Git Bash, so the Shell tool now runs commands through bash.exe (POSIX semantics) instead of powershell.exe. Windows users get the same Unix-style command syntax (&&, ||, |, /dev/null, grep, sed, etc.) as Linux/macOS. Requires Git for Windows installed: kimi-cli locates bash.exe via the KIMI_CLI_GIT_BASH_PATH env override → where.exe git → standard install paths (C:\Program Files\Git\bin\bash.exe); if none resolve, kimi-cli prints an install hint and exits at startup
Shell: Defend against hallucinated CMD-style 2>nul redirects on Windows by rewriting them to 2>/dev/null before reaching git-bash — without this defense git-bash would create a file literally named nul (a Windows reserved device name) that breaks git add . and git clone; on Linux/macOS, >nul is a legitimate redirect to a file named nul and is left untouched
File: Accept POSIX-form paths on Windows in ReadFile, WriteFile, StrReplaceFile, Glob, and Grep — these tools now recognize /c/Users/foo (Git Bash style), /cygdrive/c/Users/foo (Cygwin style), and \\server\share (UNC) in addition to native Windows paths, automatically converting to native form for filesystem operations
Shell: Clear partial streamed output when an LLM step is retried — previously, if a step failed mid-stream (e.g. rate limit or server error), the incomplete text and unfinished tool-call blocks from the aborted attempt would remain on screen and be mixed with the new attempt's output. The shell UI now discards the partial state and prints a retry banner showing the reason, attempt count, and wait time; print mode also discards buffered assistant messages on retry
Wire: Bump protocol version to 1.10 — add StepRetry event emitted when a step attempt fails and will be retried, carrying attempt count, wait time, and error details
Core: Stop plan-mode and afk-mode workflow prompts from being injected into subagents — subagents share session-level mode state for persistence, but their YAMLs typically exclude root workflow tools such as EnterPlanMode, ExitPlanMode, and AskUserQuestion. These prompt injections are now root-only. Tool-level read-only checks under plan mode are unchanged, so behavior compatibility is preserved

1.41.0 (2026-04-30)

Plugin: Support installing plugins directly from a .zip URL — kimi plugin install now accepts HTTP(S) URLs ending in .zip (e.g. GitHub/GitLab archive links like .../archive/refs/heads/main.zip) and downloads + extracts them before resolving plugin.json, in addition to the existing git URL, local directory, and local zip-file sources
Shell: Enable clipboard image paste on headless Linux over SSH — when pyperclip is unavailable (e.g. DISPLAY is not set), Ctrl-V now falls back to xclip or wl-paste so remote clipboard bridges can still inject images; also prevents a UI crash from built-in clipboard shortcuts when pyperclip is broken

1.40.0 (2026-04-28)

Core: Fix --yolo mode unintentionally preventing the model from calling AskUserQuestion — yolo used to inject a system reminder telling the model it was in "non-interactive mode" and must not ask, and the ask-user tool auto-dismissed in yolo. Both were wrong: yolo only bypasses permission approvals; it does not mean "the user is gone". Yolo no longer injects model guidance, and the user remains reachable through AskUserQuestion
CLI: Split permission bypass from unattended execution — --yolo bypasses permission approvals while the user is still at the terminal, while --afk / /afk means away-from-keyboard: AskUserQuestion is auto-dismissed and approvals are handled automatically. --print now uses runtime AFK behavior instead of yolo, matching its non-interactive execution model. The status bar shows yolo and afk independently, and /yolo and /afk toggle their own flag without disturbing the other
Config: Replace skip_yolo_prompt_injection with skip_afk_prompt_injection now that yolo no longer injects model guidance. The old config key is ignored if present
Shell: Fix /yolo toggling producing misleading UI messages when afk is also active — /yolo used to read the combined auto-approval state, so pressing it under afk would claim approval was now required even though afk still handled approvals automatically. /yolo now reads and writes only the yolo flag, leaving afk alone
Web: Fix AI title generation overwriting a manually-set title when the LLM call finishes after the user has already renamed the session — the final write now reloads state and yields to a title_generated flag set by another request
Web: Surface session rename, archive, unarchive, and title generation failures as toast notifications instead of only logging to the console
Web: Keep tool media previews visible when tool details are collapsed — images and videos returned by tools now render below the tool card instead of inside the collapsible detail area, so preview thumbnails remain accessible after collapsing a tool
Kosong: Fix stale API key after OAuth token refresh in Kimi provider — on_retryable_error now reads the current api_key from the live client instead of the cached _api_key, so that OAuth token refreshes applied via client.api_key are preserved when the client is rebuilt after a retryable error
Core: Approval requests no longer auto-timeout after 5 minutes, which previously surfaced as Rejected by user; active foreground and subagent approvals now wait indefinitely for user response

1.39.0 (2026-04-24)

Skill: Fix project-scope skills being ignored and user-scope skills silently winning name conflicts — the system prompt now groups discovered skills under ### Project / ### User / ### Extra / ### Built-in headings so the model can tell where each skill came from, and when the same name exists in multiple scopes the more specific scope wins (Project > User > Extra > Built-in) so a project's own .kimi/skills/foo or .claude/skills/foo correctly overrides a user-level or bundled foo instead of the other way around
Skill: Accept single-file <name>.md skills alongside the canonical <name>/SKILL.md subdirectory layout — useful when migrating a flat markdown collection into a skills directory; name defaults to the filename stem (frontmatter name: still wins if set), description follows the same three-step chain as subdirectory skills (frontmatter description: → first non-empty body line, capped at 240 characters → "No description provided." placeholder), and if a flat and a subdirectory skill share a name in the same directory the subdirectory wins with a warning
Skill: Add extra_skill_dirs config field for pulling in custom skill directories on top of the built-in / user / project auto-discovery — each entry may be an absolute path, a ~-prefixed path (expanded against $HOME), or a path relative to the project root (the nearest .git ancestor of the work directory, not the current working directory); non-existent entries are silently skipped and symlink/trailing-slash duplicates canonicalize to a single root so a path listed twice or aliased to an already-discovered directory does not render twice in the system prompt
Skill: Harden discovery against OSError from is_dir / iterdir (for example when an extra_skill_dirs entry points at a directory with restricted permissions) — affected entries are logged and skipped instead of aborting the whole skill-discovery pass
Core: Fix DeepSeek V4 (and other OpenAI-compatible thinking-mode backends) returning 400 The reasoning_content in the thinking mode must be passed back to the API when a tool call follows a reasoning turn — openai_legacy providers now default reasoning_key to "reasoning_content" so the response's reasoning is stored in history and round-tripped automatically on subsequent turns. An optional reasoning_key field is also added to LLMProvider to override the field name (e.g. "reasoning" for non-standard gateways) or disable round-tripping entirely by setting it to

1.38.0 (2026-04-22)

Shell: Fix Rejected by user misleading message when an approval modal times out — after the 300s safety timeout, the tool call now rejects with Rejected: approval timed out, so users returning to their session after stepping away can tell the rejection was a timeout rather than a manual rejection. Pass --yolo/-y to auto-approve tool calls if you regularly leave sessions unattended
Auth: Fix OAuth users being forced to /login again after an unrelated refresh-token rotation race — when a concurrently-running kimi-cli instance (terminal, VS Code extension, or kimi -p one-shot) legitimately rotated the refresh token, the current instance's now-stale refresh request would come back with a 401, and a TOCTOU window between the "did another instance rotate?" disk check and the delete_tokens call could wipe the credentials file even though a valid rotated token was about to be written to it; the in-memory cache is still cleared so truly revoked tokens surface on the next request, but the file is preserved so a concurrent instance's freshly-rotated token can be recovered, and an eventual /login still overwrites it atomically
Kosong: Fix parallel tool results being split into multiple user messages in Anthropic provider — consecutive tool-result-only user messages are now merged into a single message, complying with the Anthropic Messages API spec that all tool_use blocks in an assistant turn must be answered within one user message; this fixes 400 errors on strict Anthropic-compatible backends (e.g. DeepSeek /anthropic endpoint) and prevents the official backend from silently teaching the model to avoid parallel tool calls

1.37.0 (2026-04-20)

Print: Wait for background tasks before exiting — in one-shot --print mode, the process now waits for running background agents to finish and lets the model process their results, instead of exiting and killing them. The wait is capped at min(max(active_task.timeout_s or agent_task_timeout_s), print_wait_ceiling_s) (default ceiling 1h); on timeout the tasks are killed and the model gets one more turn via a <system-reminder> to summarise before exit
Shell/Print: On exit the CLI now lists each background task being killed (id + description) on stderr and waits out the configured grace period before reporting any tasks that have not reached terminal state (split into "still terminating" for workers mid-shutdown vs "stop request failed" for genuinely leaking tasks); keep_alive_on_exit=true still skips the entire path
Auth: Auto-refresh the managed model list at startup for OAuth-logged-in users — the CLI now fetches the latest models from the provider's /models endpoint as a background task when the shell launches, so newly released models become available without needing to log out and log back in; failures are silent and never block startup, and custom --config sessions keep their previous behavior
Shell: Show the provider-supplied display_name (e.g. k2.6-code-preview) for managed models across the welcome panel, prompt status bar, /model picker, and /model switch confirmation messages; when the backend does not return one, the CLI falls back to the internal model ID as before

1.36.0 (2026-04-17)

Anthropic: Fix Claude Opus 4.7 returning invalid_request_error — Opus 4.7 (which rejects the legacy {type: "enabled", budget_tokens: N} thinking config) now correctly uses adaptive thinking, and the client explicitly sets display: "summarized" so thinking content still streams back (Opus 4.7 silently changed the default to "omitted"); Bedrock/Vertex name variants (e.g., aws/claude-opus-4-7, anthropic.claude-opus-4-7-v1:0) and claude-mythos-preview are also recognised, and future Claude versions ≥ 4.6 are detected automatically via version extrapolation instead of hard-coded substring matching
Web: Fix markdown rendering spacing in the web UI — restore proper vertical spacing between paragraphs, lists, code blocks, blockquotes, and headings instead of collapsing all margins to zero
Shell: Fix missing loading indicator during active turns — the moon spinner now shows as a fallback whenever the model is working but no other indicator is visible, covering gaps after tool calls finish, between turn start and first step, and when an empty thinking block arrives from the provider
Core: Increase default max_steps_per_turn from 100 to 500 to allow longer uninterrupted agent runs out of the box
Web: Fix unresponsive copy, download, and preview buttons on rendered code blocks

1.35.0 (2026-04-15)

Shell: Flip show_thinking_stream default to true so fresh installs see the streaming reasoning preview out of the box; set it to false in your config to keep the compact 1.32 indicator
Web: Prevent stream watchdog from reconnecting during pending approval or question — the 45-second inactivity watchdog no longer triggers a reconnect while the user is actively handling an approval request or answering a question, preventing interrupted interactions
Web: Fix session recovery after stream errors — when a session process exits or hits a read-loop error, stale in-flight prompt IDs are now cleared before broadcasting the error, allowing the frontend to send new messages instead of getting "Session is busy"; the activity status indicator also surfaces the actual error message from the stream
Core: Fix Wire server prompt handler leaving sessions stuck busy on uncaught exceptions — SSL errors, connection errors, and other unexpected failures are now caught by a fallback handler and returned as INTERNAL_ERROR, allowing the session to recover instead of hanging indefinitely

1.34.0 (2026-04-14)

Core: Fix CLI crash on TaskStop — stopping a stuck background agent no longer prints Unhandled exception in event loop / Exception None and freezes the terminal; the cancelled task is now kept in the manager's live-tasks dict until its runner finishes cleaning up, preventing Python's GC from reaping the still-pending task
Shell: Fix inline diff highlights misaligned on lines containing tabs — raw-code diff offsets are now mapped to rendered positions via expandtabs column tracking so highlight spans land correctly after tab expansion
Shell: Add show_thinking_stream config option to opt back into the legacy streaming reasoning preview — when set to true, the live area shows the classic Thinking... spinner above a 6-line scrolling preview of the raw reasoning text and the full reasoning markdown is committed to history when the block ends; defaults to false to keep the compact 1.32 indicator

1.33.0 (2026-04-13)

Shell: Unify managed model display as "Kimi for Code" and drop hardcoded kimi-k2.5 version references from the welcome screen and /login tip

1.32.0 (2026-04-13)

Core: Truncate MCP tool output to 100K characters to prevent context overflow — all content types (text and inline media such as image/audio/video data URLs) share a single character budget; tools like Playwright that return full DOMs (500KB+) or large base64 screenshots are now capped with a truncation notice; oversized media parts are dropped; unsupported MCP content types are gracefully handled instead of crashing the turn
CLI: Fix PyInstaller binary missing lazy CLI subcommands — kimi info, kimi export, kimi mcp, kimi plugin, kimi vis, and kimi web now work correctly in the standalone binary distribution
Shell: Streamline the thinking indicator into a compact single-line layout — shows a Thinking label with animated dots, elapsed time, token count, and a live tokens/second pulse; finalises with a Thought for Xs · N tokens trace in history

1.31.0 (2026-04-10)

Core: Cap list_directory output as a depth-limited tree to prevent token-limit blowup in large directories — replaces the unbounded flat listing with a 2-level tree (root: 30 entries, child: 10 per subdirectory), dirs-first alphabetical sorting, and "... and N more" truncation hints so the model knows to explore further (fixes #1809)
Shell: Add blocking update gate on interactive shell startup — when a newer version is detected (from the existing background check cache), a blocking prompt appears before the shell loads, offering [Enter] to upgrade immediately, [q] to continue and be reminded next time, or [s] to skip reminders for that version; respects the KIMI_CLI_NO_AUTO_UPDATE environment variable; replaces the previous repeating toast notification for available updates
Auth: Harden OAuth token refresh to prevent unnecessary re-login — 401 errors now trigger automatic token refresh and retry instead of forcing /login; multiple simultaneous CLI instances coordinate refresh via a cross-process file lock to avoid race conditions; token persistence uses atomic writes with fsync to prevent corruption; adds dynamic refresh threshold, 5xx retry during token refresh, and proper token revocation cleanup
Core: Fix agent loop silently stopping when model response contains only thinking content — detect think-only responses (reasoning content with no text or tool calls) as an incomplete response error and retry automatically
Core: Fix crash on streaming mid-flight network disconnection — when the OpenAI SDK raises a base APIError (instead of APIConnectionError) during long-running streams, the error is now correctly classified as retryable, enabling automatic retry and connection recovery instead of an unrecoverable crash
Shell: Exclude empty current session from /sessions picker — completely empty sessions (no conversation history and no custom title) are no longer shown in the session list; sessions with a custom title are still displayed
Shell: Fix slash command completion Enter key behavior — accepting a completion now submits in a single Enter press; auto-submit is limited to slash command completions only; file mention completions (@) accept without submitting so the user can continue editing; re-completion after accepting is suppressed to prevent stale completion state
Shell: Add directory scope toggle to /sessions picker — press Ctrl+A to switch between showing sessions for the current working directory only or across all known directories; uses a new full-screen session picker UI with header scope indicator and footer hint bar
Shell: Add /btw side question command — ask a quick question during streaming without interrupting the main conversation; uses the same system prompt and tool definitions for prompt cache alignment; responses display in a scrollable modal panel with streaming support

1.30.0 (2026-04-02)

Shell: Refine idle background completion auto-trigger — resumed shell sessions no longer auto-start a foreground turn from stale pending background notifications before the user sends a message, and fresh background completions now wait briefly while the user is actively typing to avoid stealing the prompt or breaking CJK IME composition
Core: Fix interrupted foreground turns leaving unbalanced wire events — TurnEnd is now emitted even when a turn exits via cancellation or step interruption, preventing dirty session wire logs from accumulating across resume cycles
Core: Improve session startup resilience — --continue/--resume now tolerate malformed context.jsonl records and corrupted subagent, background-task, or notification artifacts; the CLI skips invalid persisted state where possible instead of failing to restore the session
CLI: Improve kimi export session export UX — kimi export now previews the previous session for the current working directory and asks for confirmation, showing the session ID, title, and last user-message time; adds --yes to skip confirmation; also fixes explicit session-ID invocations where --output after the argument was incorrectly parsed as a subcommand
Grep: Add include_ignored parameter to search files excluded by .gitignore — when set to true, ripgrep's --no-ignore flag is enabled, allowing searches in gitignored artifacts such as build outputs or node_modules; sensitive files (like .env) remain filtered by the sensitive-file protection layer; defaults to false to preserve existing behavior
Core: Add sensitive file protection to Grep and Read tools — .env, SSH private keys (id_rsa, id_ed25519, id_ecdsa), and cloud credentials (.aws/credentials, .gcp/credentials) are now detected and blocked; Grep filters them from results with a warning, Read rejects them outright; .env.example/.env.sample/.env.template are exempted
Core: Fix parallel foreground subagent approval requests hanging the session — in interactive shell mode, _set_active_approval_sink no longer flushes pending approval requests to the live view sink (which cannot render approval modals); requests stay in the pending queue for the prompt modal path; also adds a 300-second timeout to wait_for_response so that any unresolved approval request eventually raises ApprovalCancelledError instead of hanging forever
CLI: Add / (/) flag to resume sessions — without an argument opens an interactive session picker (shell UI only); with a session ID resumes that specific session; replaces the reverted / design with a unified optional-value flag

1.29.0 (2026-04-01)

Core: Support hierarchical AGENTS.md loading — the CLI now discovers and merges AGENTS.md files from the git project root down to the working directory, including .kimi/AGENTS.md at each level; deeper files take priority under a 32 KiB budget cap, ensuring the most specific instructions are never truncated
Core: Fix empty sessions lingering on disk after exit — sessions created but never used are now cleaned up on all exit paths (failure exit, session switch, unexpected errors), not just on successful exit
Shell: Add KIMI_CLI_PASTE_CHAR_THRESHOLD and KIMI_CLI_PASTE_LINE_THRESHOLD environment variables to control when pasted text is folded into a placeholder — lowering these thresholds works around CJK input method breakage after multiline paste on some terminals (e.g., XShell over SSH)
Shell: Fix diff panel rendering corruption on terminals without truecolor support (e.g. Xshell) — render_to_ansi no longer hardcodes 24-bit color; Rich now auto-detects terminal capability via COLORTERM/TERM environment variables
Web: Fix white screen after CLI upgrade caused by browser caching stale index.html — the server now returns Cache-Control: no-cache for HTML and immutable for hashed assets, preventing 404s on renamed chunks
Core: Fix file write converting LF to CRLF on Windows — writetext now opens files with newline="" to prevent Python's universal newline translation from silently converting \n to \r\n
Core: Support socks:// proxy scheme — proxy tools like V2RayN set ALL_PROXY=socks://... which httpx/aiohttp don't recognise; the CLI now normalises socks:// to socks5:// at startup so all HTTP clients and subprocesses work correctly behind a SOCKS proxy
Shell: Add /title (alias /rename) command to manually set session titles — titles are now stored in state.json alongside other session state; legacy metadata.json is automatically migrated on first load
Shell: Fix garbled pager output when MANPAGER is set (e.g. bat) — the console pager now ignores MANPAGER and delegates to pydoc.pager(), preserving PAGER and all platform-specific fallbacks
Explore: Enhance explore agent with specialist role, thoroughness levels, and automatic environment context — explore agents now gather repository environment information at launch to improve investigation quality; the main agent is guided to prefer explore for codebase research and plan mode encourages explore-first investigation