Upstream kimi-code — Daily Summary (2026-07-27 #2): secondary_model config API, hostIdentity domain, cloud telemetry

[zicochaos]

Upstream changes (since a9af42e69, 2026-07-27)

Upstream advanced by 5 new commits (git fetch upstream main; new tip 77618e38c, 2026-07-27). The fork is now 13 commits behind upstream total. New work is concentrated in kap-server config/telemetry, a new agent-core-v2 system-prompt domain, and CLI plugin notices.

⚙️ kap-server — secondary_model config API (3b017821c, MoonshotAI#2228)

POST /api/v1/config now accepts secondary_model, persisted to the [secondary_model] config section via generic per-domain dispatch. GET /config hides the synthesized __secondary__ derived entry from the models view (matching GET /models). Gated by KIMI_CODE_EXPERIMENTAL_SECONDARY_MODEL, ignored by the interactive TUI. The follow-up 086769bfa (MoonshotAI#2243) drops the changelog entry since the feature is still experimental.

🆔 agent-core-v2 — hostIdentity domain (a77ee0382, MoonshotAI#2144)

New app-scope (L3) hostIdentity domain: productName / replyStyleGuide overrides + hostIdentitySeed for composition roots. Renders ${product_name} and ${reply_style_guide} in the base system prompt, falling back to CLI defaults. Seeded from AgentProfileService via IHostIdentity; exposed on kap-server's ServerStartOptions. Adapted to the recent DI refactor (ScopeActivation.OnScopeCreated replaces the removed InstantiationType).

🔌 cli — plugin quota + update notices (29783e471, MoonshotAI#2147)

• Shows "This plugin consumes your quota." after installing quota-consuming official plugins (currently Kimi Datasource).
• One-time update notice after invoking an outdated plugin; last-notified version persisted.
• Notable: a review reverted the dev-marketplace trust relaxation (loopback carve-out was a P1 — it let any local service bypass third-party trust). Only https://code.kimi.com/kimi-code/plugins/official/* is trusted now.
• Update notices restricted to the default official catalog; MCP tool-name truncation (64-char core limit) handled via longest-prefix matching.

📊 kap-server — cloud telemetry for engine events (77618e38c, MoonshotAI#2230)

The v2 engine registers a full telemetry event catalog, but kap-server never attached an appender — events from web-hosted sessions dropped to the null appender. Adds an opt-in telemetry start option attaching a CloudAppender (app_name kimi-code-cli, ui_mode web), still gated by the config telemetry toggle, with periodic flush + bounded flush on close. Defaults off (tests never hit the real endpoint); the kimi web host enables it.

Impact on this fork

Conflict count rose from 6 to 9. A full git merge-tree dry-run of all 13 upstream commits into main reports 9 content conflicts. The 3 new conflicts come from secondary_model + hostIdentity work landing in the same config/profile files the fork has modified:

Severity	File	Fork change	New upstream change	Conflict nature
🔴 New	packages/agent-core-v2/src/agent/profile/profileService.ts	AGENTS.md includes (417d8e117, 138b7bb6f) + skills guidance (50c148327)	hostIdentity seeds IHostIdentity from AgentProfileService (MoonshotAI#2144)	fork edited profileService; upstream re-instrumented it for system-prompt identity seeding
🔴 New	packages/kap-server/src/routes/config.ts	session-only default model (6272ddf1f) + disabled_skills denylist (b168c608e)	secondary_model config API dispatch (MoonshotAI#2228)	both extend the same config route — generic per-domain dispatch collides with fork's config additions
🟡 New	packages/kap-server/test/config.test.ts	config test updates (6272ddf1f, c4346884b)	secondary_model config tests (MoonshotAI#2228)	test assertions for the same route collide

The other 2 new commits auto-merge cleanly:

• 77618e38c (telemetry) and 29783e471 (plugin notices) — no overlap with fork's diverged files; 086769bfa is a changelog-only drop.

The 6 carry-over conflicts from prior days are unchanged: 🔴 agentSwarmTool.ts, agentTool.ts, skillCatalogService.ts; 🟡 swarm.test.ts, skillCatalog.test.ts, tool.test.ts (tracked in #8).

Bottom line: The config/profile surface is now the second conflict hot zone after the agent-core-v2 DI refactor. The fork's session-only-default-model and disabled_skills config work directly overlaps upstream's new secondary_model API route and hostIdentity profile seeding.

Recommended follow-ups

• Conflict count up to 9 (+3 from yesterday). Still recommend a single git merge upstream/main on a fresh branch (13 commits, two entangled refactors — don't cherry-pick).
• New 🔴 — resolve profileService.ts: re-apply fork's AGENTS.md-includes + skills-guidance changes onto upstream's IHostIdentity seeding. Likely composable (different concerns: AGENTS.md loading vs. system-prompt identity vars) but needs manual resolution.
• New 🔴 — resolve routes/config.ts: reconcile fork's session-only-default-model + disabled_skills additions with upstream's secondary_model per-domain dispatch. Verify the fork's config keys still route correctly through the generic dispatch and aren't shadowed.
• New 🟡 — update config.test.ts: merge fork's config test cases with upstream's secondary_model tests on the new route shape.
• Carry-forward the original 6 conflicts (subagent-model + skills porting, tracked in Upstream kimi-code — Daily Summary (2026-07-26): agent-core-v2 DI refactor #8).
• Informational — telemetry (77618e38c): no fork conflict, but if the fork's kimi web host or any kap-server entrypoint is customized, confirm the opt-in telemetry start option defaults off and the CloudAppender isn't accidentally enabled in fork-specific tests.
• Informational — plugin notices (29783e471): the reverted dev-marketplace trust relaxation means official plugins installed from a loopback/dev marketplace now show the trust prompt again. If the fork runs a dev plugin marketplace, behavior changed.

---

Upstream tip: 77618e38c (2026-07-27). Fork is 16 commits ahead, 13 behind. Conflict set grew (6→9); config/profile is the new hot zone. Generated by daily upstream-summary automation.

[zicochaos]

Superseded by #23, which reflects the current fork/upstream graph and a fresh merge-conflict simulation.