kovidgoyal/kitty · error

KITTY_PUBLIC_KEY has unknown version, if you are running on

Error message

KITTY_PUBLIC_KEY has unknown version, if you are running on a remote system, update kitty on this system

What it means

The version prefix of KITTY_PUBLIC_KEY does not match the RC_ENCRYPTION_PROTOCOL_VERSION this kitty @ binary supports. The kitty instance that exported the key speaks a different (usually newer or much older) remote-control encryption protocol.

Source

Thrown at tools/cmd/at/main.go:87

	struct_in_interface.FieldByName(field).SetString(data)
	payload_interface.Set(struct_in_interface) // copies struct_in_interface back to payload
}

func get_pubkey(encoded_key string) (encryption_version string, pubkey []byte, err error) {
	if encoded_key == "" {
		encoded_key = os.Getenv("KITTY_PUBLIC_KEY")
		if encoded_key == "" {
			err = fmt.Errorf("Password usage requested but KITTY_PUBLIC_KEY environment variable is not available")
			return
		}
	}
	encryption_version, encoded_key, found := strings.Cut(encoded_key, ":")
	if !found {
		err = fmt.Errorf("KITTY_PUBLIC_KEY environment variable does not have a : in it")
		return
	}
	if encryption_version != kitty.RC_ENCRYPTION_PROTOCOL_VERSION {
		err = fmt.Errorf("KITTY_PUBLIC_KEY has unknown version, if you are running on a remote system, update kitty on this system")
		return
	}
	pubkey = make([]byte, base85.DecodedLen(len(encoded_key)))
	n, err := base85.Decode(pubkey, []byte(encoded_key))
	if err == nil {
		pubkey = pubkey[:n]
	}
	return
}

type escaped_string string

func (s escaped_string) MarshalJSON() ([]byte, error) {
	// See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON
	// we additionally escape all non-ascii chars so they can be safely transmitted inside an escape code
	src := utf16.Encode([]rune(s))
	buf := make([]byte, 0, len(src)+128)
	a := func(x ...byte) {

View on GitHub (pinned to 6d5d0c4406)

Solutions

1. Update kitty so both systems run the same version (the message explicitly suggests this for remote setups)
2. Or run the kitty @ binary that matches the running kitty (fix PATH so the correct binary is found)
3. Check 'kitty --version' on both ends to confirm they match

local, remote := kittyVersion(), remoteVersion()
if local != remote { /* align versions before using password RC */ }

if _, _, err := get_pubkey(key); err != nil { /* update kitty on the mismatched side and retry */ }

When it happens

Trigger: Mixing kitty versions: e.g. a newer kitty exports KITTY_PUBLIC_KEY with version 2 while the remote host's kitty @ binary only understands version 1, or vice versa.

Common situations: Running kitty @ on a remote machine over ssh where the remote kitty package is older/newer than the local kitty that set the variable.

Related errors

• Ignoring encrypted rc command with unsupported protocol: {pc
• Unsupported version received in edit protocol: {self.version
• KITTY_PUBLIC_KEY has unknown version, if you are running on
• Ignoring encrypted rc command without a public key
• This should be run as kitten icat

AI-assisted analysis of kovidgoyal/kitty@6d5d0c4406 (2026-08-27). Data as JSON: /api/errors/a0cdeb261324db66. Report an issue: GitHub.