MoonshotAI/kimi-code @moonshot-ai/kimi-code@0.25.0

@moonshot-ai/kimi-code@0.25.0

Repository: MoonshotAI/kimi-code

Tag: @moonshot-ai/kimi-code@0.25.0

Published: 2026-07-16T02:20:10Z

Prerelease: no

Release notes:

Minor Changes

• #1731 `0b790cd` Thanks @sailist! - web: Allow attaching any file type in chat; files the model cannot consume inline (documents, SVG images, archives, …) are uploaded to the server and given to the model as a file path it can read on demand.

Patch Changes

• #1746 `918c135` Thanks @RealKai42! - Honor adaptive_thinking = false on Anthropic-compatible models by limiting thinking efforts to the legacy budget set and omitting the effort parameter from requests.

• #1746 `918c135` Thanks @RealKai42! - Apply official Anthropic effort profiles and a 128k output fallback for unknown models. Preserve compatible-provider thinking history across session resumes and model switches, normalize incomplete stream events, and warn on unlisted efforts.

• #1746 `918c135` Thanks @RealKai42! - Fix custom-named models on Anthropic-compatible providers starting new sessions with thinking effort off instead of the model default, and not showing the thinking control in ACP clients.

• #1757 `f0c8a10` Thanks @RealKai42! - Fix the diagnostic log missing the actual error when the CLI exits unexpectedly.

• #1731 `0b790cd` Thanks @sailist! - Fix the Content-Security-Policy on non-loopback server binds blocking the web UI's theme bootstrap script and bundled fonts, and tighten the policy with explicit form-action, base-uri, and frame-ancestors directives.

• #1758 `1d7c205` Thanks @RealKai42! - Fix the CLI exiting unexpectedly when reading an image from the clipboard fails; it now falls back to pasting text.

• #1753 `d8ddabb` Thanks @sailist! - Fix the web server bearer-token check being bypassed by percent-encoded API paths (e.g. /%61pi/v1/…), which allowed unauthenticated access to every API route.

• #1758 `1d7c205` Thanks @RealKai42! - Report crash telemetry for unhandled promise rejections, so exits they cause are no longer invisible.

• #1753 `d8ddabb` Thanks @sailist! - Fix the session filesystem API following symlinks that point outside the workspace, which allowed reading, listing, creating, and downloading host files beyond the session directory through a planted symlink.

• #1753 `d8ddabb` Thanks @sailist! - Fix sessions failing to be created when the workspace directory is given through a symlink, which the v2 engine rejected as "not a directory".

• #1754 `1186686` Thanks @wbxl2000! - web: Fix completed background subagents losing their final output after a session reload, and retry the output backfill when a transient fetch failure occurs.

• #1755 `4f99114` Thanks @kermanx! - Move the server's v1 wire schema definitions into the engine domains and the server package, removing the shared schema package from the v2 server stack with no behavior change.

• #1731 `0b790cd` Thanks @sailist! - web: Show every attachment a user sends — files, images, and videos — as chips in the message bubble, and let files be attached by dropping them anywhere in the window.

• #1744 `b89d385` Thanks @wbxl2000! - web: Fix Enter not confirming modal confirmation dialogs in dev builds, and keep the dialog open with a loading state until the confirmed action (such as archiving a session) completes.

• #1756 `e885aec` Thanks @wbxl2000! - web: Show full diagnostics for model request failures — a semantic title, the provider's raw message, and expandable details (error code, HTTP status, request ID) with copy support — instead of a bare "Connection error" toast.

• #1751...