feat: make Kimi K2.6 default and allow newer Kilo versions

AGENTS.md

@@ -30,13 +30,14 @@ Current honest state:
   selection, while staying explicit that Kilo can recreate that cache later
 - the XDG-isolated oracle now mirrors user-level global Kilo config into the
   sandbox XDG config tree so project-scope verification matches the local
-  resolver on supported `@kilocode/cli@7.2.0` installs, and that temporary
-  sandbox now stages outside the repository with cleanup after verification
+  resolver on `@kilocode/cli >=7.2.0` installs, and that temporary sandbox now
+  stages outside the repository with cleanup after verification
 - the stock public build now ships `moonshotai/Kimi-K2.6` as the recommended
   validated curated default, with installer-managed
   `limit.output = 8192` for Kilo `7.2.0` compatibility
-- exact support remains pinned to `@kilocode/cli@7.2.0`; later `7.2.x`
-  versions are not implied
+- Kilo detection now accepts `@kilocode/cli >=7.2.0` without pre-blocking
+  future Kilo releases, while the audited compatibility baseline remains
+  `@kilocode/cli@7.2.0`
 - native Windows production support is not yet claimed because the native
   oracle-safety proof gate is still open
 - repository-side release automation is now checked in through
@@ -84,7 +85,8 @@ These are repo-contract decisions, not casual refactors:
 - future `/v1/responses` support must be a migration, not a present claim
 - primary command: `kilo`
 - fallback alias: `kilocode`
-- exact investigated Kilo compatibility profile: `@kilocode/cli@7.2.0`
+- minimum accepted Kilo compatibility floor: `@kilocode/cli >=7.2.0`
+- audited Kilo compatibility baseline: `@kilocode/cli@7.2.0`
 - Kilo runtime env vars: `KILO_CONFIG`, `KILO_CONFIG_DIR`,
   `KILO_CONFIG_CONTENT`
 - durable global target: `~/.config/kilo/kilo.jsonc`

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Accepted Kilo versions at or above `@kilocode/cli >=7.2.0` instead of
+  pre-blocking future Kilo releases with the previous `7.2.0`-only gate.
 - Promoted `moonshotai/Kimi-K2.6` to the recommended validated curated
   default, with installer-managed `limit.output = 8192` for Kilo `7.2.0`
   compatibility.

README.md

@@ -8,7 +8,7 @@ npx @gonkagate/kilo-setup
 
 ![Package](https://img.shields.io/badge/package-%40gonkagate%2Fkilo--setup-6E63FF?style=flat-square)
 ![Node](https://img.shields.io/badge/node-%3E%3D22.14.0-4DA2FF?style=flat-square)
-![Kilo](https://img.shields.io/badge/kilo-7.2.0-35D6FF?style=flat-square)
+![Kilo](https://img.shields.io/badge/kilo-%3E%3D7.2.0-35D6FF?style=flat-square)
 ![License](https://img.shields.io/badge/license-Apache--2.0-2A2A2A?style=flat-square)
 
 [![Website](https://img.shields.io/badge/Website-gonkagate.com-111827?style=flat-square)](https://gonkagate.com/en)
@@ -52,7 +52,7 @@ What it does for you:
 What it does not do:
 
 - it does not install Kilo itself
-- it does not claim support beyond exact `@kilocode/cli@7.2.0`
+- it does not install or pin Kilo versions for you
 - it does not claim GonkaGate `responses` support today
 - it does not claim native Windows production support yet
 
@@ -63,7 +63,7 @@ You need:
 - Node `>=22.14.0`
 - local `kilo` installed and available on `PATH`, or the fallback `kilocode`
   command
-- local Kilo matching the exact investigated profile: `@kilocode/cli@7.2.0`
+- local Kilo matching the minimum accepted floor: `@kilocode/cli >=7.2.0`
 - a GonkaGate API key in the usual `gp-...` format from the
   [dashboard](https://gonkagate.com/en/register)
 
@@ -74,7 +74,7 @@ Current public baseline:
 - current transport target: `chat/completions`
 - curated default:
   `moonshotai/Kimi-K2.6`
-- installer-managed `limit.output = 8192` for exact `@kilocode/cli@7.2.0`
+- installer-managed `limit.output = 8192` for Kilo compatibility
 - no native Windows production claim yet
 
 ## Shortest Start Path
@@ -90,7 +90,7 @@ npx @gonkagate/kilo-setup
 The installer will:
 
 1. detect `kilo`, or fall back to `kilocode`
-2. verify exact `@kilocode/cli@7.2.0`
+2. verify local Kilo is at least `@kilocode/cli >=7.2.0`
 3. show the curated model choice
 4. choose the recommended scope automatically:
    - inside a git repository: `project`
@@ -197,14 +197,16 @@ Scope rules:
 
 This repository intentionally stays narrow today:
 
-- exact investigated compatibility profile: `@kilocode/cli@7.2.0`
+- minimum accepted Kilo floor: `@kilocode/cli >=7.2.0`
 - current transport target: `chat/completions`
 - current curated default:
   `moonshotai/Kimi-K2.6`
 - real-path Kilo verification is not the production default
 - native Windows production support is not claimed yet
-- later Kilo patch releases, unvalidated extra models, and new flows are not
-  implied just because this package exists
+- future Kilo releases are not pre-blocked by version, but observed
+  compatibility breaks still need fixes
+- unvalidated extra models and new flows are not implied just because this
+  package exists
 
 The shipped runtime treats effective Kilo config as the real success gate. It
 uses the local resolver as the durable verifier and keeps the XDG-isolated

docs/README.md

@@ -24,4 +24,5 @@ Current contract documents:
 
 This repository ships the Kilo installer runtime with a validated curated Kimi
 K2.6 default, installer-managed `limit.output = 8192` for Kilo compatibility,
-and support claims that stay pinned to exact `@kilocode/cli@7.2.0`.
+and a minimum accepted Kilo floor of `@kilocode/cli >=7.2.0` without a preset
+upper version bound.

docs/gonkagate-x-kilo.md

@@ -0,0 +1,174 @@
+# GonkaGate x Kilo
+
+Hi everyone,
+
+We put together a small setup utility for Kilo:
+
+```bash
+npx @gonkagate/kilo-setup
+```
+
+The goal is simple. If you already use `kilo` and already have a GonkaGate
+API key, setup should take a minute or two. It should not turn into "open
+three docs tabs, figure out where Kilo wants provider config, then hope you
+didn't leave a secret in the repo by accident."
+
+That is what `@gonkagate/kilo-setup` is for.
+
+> Short version: this is a small CLI that wires local `kilo` to GonkaGate,
+> keeps the secret out of repo-local config, and verifies the resolved result
+> before sending you back to plain `kilo`.
+
+## Why we made it
+
+Manual provider setup is manageable once. It gets old fast after that.
+
+The annoying part is not the API itself. The annoying part is everything around
+it: where the secret should live, which config layer should own what, whether
+project config is safe to commit, and whether Kilo is actually using the
+config you just wrote instead of something else from the current shell.
+
+We wanted a short path that does the boring work correctly and stays honest
+about its limits.
+
+## The short version
+
+### Interactive
+
+```bash
+npx @gonkagate/kilo-setup
+```
+
+### Non-interactive
+
+With `GONKAGATE_API_KEY`:
+
+```bash
+GONKAGATE_API_KEY="$GONKAGATE_API_KEY" npx @gonkagate/kilo-setup --scope project --yes
+```
+
+With stdin:
+
+```bash
+printf '%s' "$GONKAGATE_API_KEY" | npx @gonkagate/kilo-setup --api-key-stdin --scope project --yes
+```
+
+With project-scope cache cleanup:
+
+```bash
+printf '%s' "$GONKAGATE_API_KEY" | npx @gonkagate/kilo-setup --api-key-stdin --scope project --clear-kilo-model-cache --yes
+```
+
+### After setup
+
+Go back to plain `kilo`.
+
+```bash
+kilo
+```
+
+## What the installer actually does
+
+At a high level, it does four things:
+
+1. Figures out the local Kilo situation.
+2. Writes the minimum safe config.
+3. Keeps the secret in user scope, not in the repository.
+4. Verifies the resolved result instead of trusting file writes.
+
+More concretely:
+
+- it detects `kilo`, or falls back to `kilocode`
+- it accepts Kilo versions at or above `@kilocode/cli >=7.2.0` without a
+  preset upper bound
+- it accepts the API key through a hidden prompt, `GONKAGATE_API_KEY`, or
+  `--api-key-stdin`
+- it rejects plain `--api-key`
+- it stores the managed secret at `~/.gonkagate/kilo/api-key`
+- it writes the user-level `provider.gonkagate` definition and canonical
+  `{file:~/.gonkagate/kilo/api-key}` binding
+- it chooses the recommended scope automatically
+- inside a git repo, that usually means `project`
+- outside a repo, that usually means `user`
+- on reruns, it only asks about scope when the previous installer-managed scope
+  no longer matches the new recommendation
+- in `project` scope, it writes only activation settings into
+  `.kilo/kilo.jsonc`
+- it creates rollback backups before replacing installer-managed files
+- it preserves unrelated Kilo config where it can
+- it verifies the durable plain-`kilo` result with the local resolver
+- if the current shell is still affected by `KILO_CONFIG`,
+  `KILO_CONFIG_DIR`, or `KILO_CONFIG_CONTENT`, it reports that separately
+- for project installs, it can also clear Kilo's current global UI-model cache
+
+That last part matters more than it sounds. A config write is easy. A correct
+resolved config is the part that actually counts.
+
+## A couple of details that mattered to us
+
+`project` scope is intentionally narrow. The repository gets activation only.
+The provider definition and secret binding stay in user config. That keeps
+`.kilo/kilo.jsonc` commit-safe by default and avoids the usual "why is there a
+secret-related path in git" problem.
+
+We also did not want a setup command that happily prints or spreads the secret
+around. The installer does not write to `auth.json`, does not generate `.env`
+files, and does not touch shell profiles.
+
+The other important part is verification. The runtime treats effective Kilo
+config as the real success gate. If the durable install is fine but the current
+shell is still overridden by runtime-only Kilo env vars, the tool says so
+instead of pretending everything is clean.
+
+## Current model and transport
+
+Right now the public default is deliberately small:
+
+- package: `@gonkagate/kilo-setup`
+- provider id: `gonkagate`
+- base URL: `https://api.gonkagate.com/v1`
+- transport: `chat/completions`
+- minimum Kilo floor: `@kilocode/cli >=7.2.0`
+- recommended validated model: `moonshotai/Kimi-K2.6`
+- managed limits: `limit.context = 262144`, `limit.output = 8192`
+
+We are treating model support as a curated list, not as a vague "it probably
+works" promise.
+
+## What we are not claiming
+
+The current boundaries are deliberate:
+
+- no upper Kilo version pin by default
+- no `/v1/responses` support today
+- no plain `--api-key`
+- no `.env` generation
+- no shell profile edits
+- no direct writes to `auth.json`
+- no production-ready native Windows claim yet
+- no claim that project config alone is enough on a brand-new machine
+- no claim that live real-path `kilo debug config` against user paths is the
+  production default verifier
+
+If `/v1/responses` support shows up later, that should be a real migration, not
+something implied by marketing copy.
+
+## Links
+
+### Project
+
+- [Repository](https://github.com/GonkaGate/kilo-setup)
+- [npm package](https://www.npmjs.com/package/@gonkagate/kilo-setup)
+- [Issues and feedback](https://github.com/GonkaGate/kilo-setup/issues)
+- [Changelog](https://github.com/GonkaGate/kilo-setup/blob/main/CHANGELOG.md)
+- [GonkaGate website](https://gonkagate.com/en)
+- [Get a GonkaGate API key](https://gonkagate.com/en/register)
+- [GonkaGate docs](https://gonkagate.com/en/docs)
+
+### Docs
+
+- [README](https://github.com/GonkaGate/kilo-setup/blob/main/README.md)
+- [User guide](https://github.com/GonkaGate/kilo-setup/blob/main/docs/user-guide.md)
+- [How it works](https://github.com/GonkaGate/kilo-setup/blob/main/docs/how-it-works.md)
+- [Security notes](https://github.com/GonkaGate/kilo-setup/blob/main/docs/security.md)
+- [Troubleshooting](https://github.com/GonkaGate/kilo-setup/blob/main/docs/troubleshooting.md)

docs/how-it-works.md

@@ -16,7 +16,7 @@ The runtime is implemented and shipped.
 Today the repository ships:
 
 - the public CLI runtime
-- Kilo detection for exact `@kilocode/cli@7.2.0`
+- Kilo detection for `@kilocode/cli >=7.2.0` without a preset upper bound
 - safe secret intake, managed secret persistence, managed Kilo config
   parse/merge/write, rollback, install-state persistence, and redacted result
   rendering
@@ -26,8 +26,9 @@ Today the repository ships:
 
 Current public limit:
 
-- the published contract stays intentionally narrow to exact
-  `@kilocode/cli@7.2.0`, `chat/completions`, and non-Windows production claims
+- the published contract keeps a minimum Kilo floor of
+  `@kilocode/cli >=7.2.0`, `chat/completions`, and non-Windows production
+  claims
 - the curated default is
   `moonshotai/Kimi-K2.6` with `limit.context = 262144` and
   `limit.output = 8192`
@@ -37,7 +38,7 @@ Current public limit:
 ## Install Flow
 
 1. Check that `kilo` is available, or fall back to `kilocode`.
-2. Verify the exact supported compatibility profile: `@kilocode/cli@7.2.0`.
+2. Verify the minimum accepted Kilo floor: `@kilocode/cli >=7.2.0`.
 3. Resolve the curated model choice and scope.
 4. Use the recommended scope automatically in the default interactive flow:
    - `project` inside a git repository
@@ -113,9 +114,10 @@ That means:
 
 The repository must stay explicit about what is not yet claimed:
 
-- no support claim beyond exact `@kilocode/cli@7.2.0`
+- no Kilo version pin beyond the minimum accepted `@kilocode/cli >=7.2.0`
 - no GonkaGate `responses` transport claim
 - no production-ready native Windows claim before the native oracle-safety
   proof exists
-- no implication that later `7.2.x` Kilo builds, broader model catalogs, or
-  native Windows are already proven just because the current default is public
+- no implication that every future Kilo behavior, broader model catalog, or
+  native Windows path is already proven just because the current default is
+  public

docs/readme-header-style.md

@@ -177,7 +177,7 @@ npx @gonkagate/kilo-setup
 
 ![Package](https://img.shields.io/badge/package-%40gonkagate%2Fkilo--setup-6E63FF?style=flat-square)
 ![Node](https://img.shields.io/badge/node-%3E%3D22.14.0-4DA2FF?style=flat-square)
-![Kilo](https://img.shields.io/badge/kilo-7.2.0-35D6FF?style=flat-square)
+![Kilo](https://img.shields.io/badge/kilo-%3E%3D7.2.0-35D6FF?style=flat-square)
 ![License](https://img.shields.io/badge/license-Apache--2.0-2A2A2A?style=flat-square)
 
 [![Website](https://img.shields.io/badge/Website-gonkagate.com-111827?style=flat-square)](https://gonkagate.com/en)

docs/release-readiness.md

@@ -15,7 +15,7 @@ docs, and tests for these facts:
 - public entrypoint: `npx @gonkagate/kilo-setup`
 - binary names: `kilo-setup` and `gonkagate-kilo`
 - Kilo command contract: `kilo` first, `kilocode` as fallback
-- exact compatibility claim: `@kilocode/cli@7.2.0`
+- minimum Kilo compatibility floor: `@kilocode/cli >=7.2.0`
 - current GonkaGate transport claim: `chat/completions`
 - curated public default:
   `moonshotai/Kimi-K2.6`
@@ -40,16 +40,20 @@ Moonshot metadata checked on 2026-04-29:
 - the package writes `limit.output = 8192` as the installer-managed Kilo
   compatibility clamp because Kilo `7.2.0` requires a numeric output limit in
   custom model config
+- npm registry metadata checked on 2026-04-29 showed `@kilocode/cli` patch
+  releases in the `7.2.x` line, including `7.2.14`, with both `kilo` and
+  `kilocode` binaries still exposed by the wrapper package
+- future Kilo releases are not pre-blocked by version; observed compatibility
+  breaks should be handled as bugs with targeted fixes
 
 ## Explicitly Not Shipped Yet
 
 The repository must continue to avoid these claims:
 
-- no support claim for Kilo versions beyond exact `7.2.0`
 - no claim that GonkaGate `responses` transport works today
 - no claim that real-path Kilo verification is the production default
 - no claim that native Windows production support is proven
-- no claim that later Kilo patch releases or additional GonkaGate models are
+- no claim that every future Kilo behavior or additional GonkaGate model is
   proven just because the current curated default is shipped
 
 ## Remaining Follow-Up Items
@@ -64,5 +68,6 @@ repository-only pass:
   `@gonkagate/kilo-setup`
 
 Those items do not change the current package contract: the publishable surface
-remains the exact Kilo baseline, the validated Kimi curated default, and the
-current non-Windows verification policy documented above.
+remains the minimum Kilo `7.2.0` floor without an upper version bound, the
+validated Kimi curated default, and the current non-Windows verification policy
+documented above.

docs/troubleshooting.md

@@ -23,13 +23,15 @@ Common reasons:
 
 - `kilo` and `kilocode` are both missing from `PATH`
 - `kilo --version` output could not be parsed safely
-- local Kilo is present, but it is not exact `@kilocode/cli@7.2.0`
+- local Kilo is present, but it is older than `@kilocode/cli >=7.2.0`
 - a higher-precedence Kilo layer such as `KILO_CONFIG`,
   `KILO_CONFIG_DIR`, or `KILO_CONFIG_CONTENT` overrides the intended result
 - provider allow/deny settings still disable `gonkagate`
 
-The repository intentionally does not treat `7.2.5` as patch-compatible with
-`7.2.0` by implication.
+The repository does not pre-block future Kilo releases by version. If a newer
+Kilo release changes config behavior in a way that breaks setup, treat that as
+a compatibility bug to investigate and fix rather than as a version gate to add
+by default.
 
 ## Why Does Project Scope Still Need Setup On Each Machine?