Skip to content

Comments

feat: add X-KiloCode-MachineId header to API requests#331

Merged
chrarnoldus merged 3 commits intodevfrom
session/agent_8ba846fa-10ac-4d6d-a61a-d26dd567770c
Feb 17, 2026
Merged

feat: add X-KiloCode-MachineId header to API requests#331
chrarnoldus merged 3 commits intodevfrom
session/agent_8ba846fa-10ac-4d6d-a61a-d26dd567770c

Conversation

@kiloconnect
Copy link
Contributor

@kiloconnect kiloconnect bot commented Feb 16, 2026

Summary

Adds a new X-KILOCODE-MACHINEID HTTP header to API requests sent to the Kilo gateway. The machine ID is a persistent UUID that uniquely identifies the machine.

Details

The machine ID reuses the existing telemetry identity system (Identity.getMachineId() from @kilocode/kilo-telemetry), which stores the ID in the global XDG data directory (~/.local/share/kilo/telemetry-id). If a machine ID already exists, it is reused; otherwise, a new UUID is generated and persisted.

Changes

  • packages/kilo-gateway/src/api/constants.ts: Add HEADER_MACHINEID constant (X-KILOCODE-MACHINEID)
  • packages/kilo-gateway/src/headers.ts: Add machineId option to buildKiloHeaders() and X_KILOCODE_MACHINEID alias
  • packages/kilo-gateway/src/index.ts: Export HEADER_MACHINEID
  • packages/opencode/src/session/llm.ts: Send machine ID header on Kilo provider API requests using Identity.getMachineId()

Key design decisions

  • No new storage: Reuses the existing telemetry-id file in the global XDG data directory — no data is written to the project/working directory
  • Follows existing patterns: Same approach as HEADER_PROJECTID and other X-KiloCode-* headers
  • Graceful fallback: If machine ID cannot be resolved, the header is simply omitted

Built for Christiaan by Kilo for Slack

Built for Christiaan by Kilo for Slack

Add a new X-KILOCODE-MACHINEID header to API requests sent to the Kilo
gateway. The machine ID is a persistent UUID that uniquely identifies
the machine, reusing the existing telemetry identity system which stores
the ID in the global XDG data directory (~/.local/share/kilo/telemetry-id).

Changes:
- Add HEADER_MACHINEID constant to kilo-gateway constants
- Add machineId option to buildKiloHeaders function
- Export HEADER_MACHINEID from kilo-gateway package
- Send machine ID header on kilo provider API requests in session/llm.ts
  using Identity.getMachineId() from kilo-telemetry
@kiloconnect
Copy link
Contributor Author

kiloconnect bot commented Feb 16, 2026

Code Review Summary

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 3
SUGGESTION 0
Issue Details (click to expand)

WARNING

File Line Issue
packages/opencode/src/session/llm.ts 165 Sanitize/validate machineId before using it to construct headers (avoid header injection / invalid header values).
packages/opencode/src/session/llm.ts 244 Sanitize/validate machineId before sending it as X-KILOCODE-MACHINEID.
packages/kilo-gateway/src/headers.ts 75 Sanitize/validate machineId before adding it to request headers (potential header injection if it contains CR/LF).
Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File Line Issue
Files Reviewed (4 files)

@chrarnoldus
Copy link
Contributor

tested locally, didn't see a file show up in the working directory

@chrarnoldus chrarnoldus merged commit e0d1593 into dev Feb 17, 2026
7 checks passed
@chrarnoldus chrarnoldus deleted the session/agent_8ba846fa-10ac-4d6d-a61a-d26dd567770c branch February 17, 2026 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants