Merge remote-tracking branch 'origin/main' into feat/cli-vim-mode-prompt

2026-08-29 03:44:06 +08:00 · 2026-07-06 16:03:20 -03:00
parent 2be834fbfc ea0f5a044f
commit 9ce665d3ee
2233 changed files with 170582 additions and 109905 deletions
@@ -4,7 +4,7 @@ This directory contains changeset files used to track changes for the next relea

 ## Adding a changeset

-When making a user-facing change, run:
+When making a user-facing change, prefer one concise changeset per PR, grouping related changes when possible. Run:

 ```sh
 bunx changeset add
@@ -1,7 +0,0 @@
---
-"@kilocode/cli": patch
-"@kilocode/kilo-indexing": patch
-"kilo-code": patch
---
-
-Support unauthenticated OpenAI-compatible endpoints for codebase indexing without requiring a placeholder API key.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Support multiple provider APIs, adaptive thinking, split reasoning, and output effort variants for custom providers.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Prevent snapshot initialization progress from blocking conversations after the slow repository prompt.
@@ -1,6 +0,0 @@
---
-"@kilocode/cli": patch
-"kilo-code": patch
---
-
-Show a clear, retryable provider rate-limit error instead of raw response JSON in chat.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Support closing other Agent Manager tabs from the tab context menu.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Hide TUI news after they have been opened and add a button to close the news dialog.
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Fix cloud session fork commands so they import cloud sessions before validating the local session.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Support opening code edit and diff blocks expanded by default in the VS Code chat.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-console": patch
+---
+
+Replace the hardcoded "K" letter in the Kilo Console navbar with the real Kilo logo, and drop the redundant "Kilo" wordmark since the logo already carries the name.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-web-ui": patch
+---
+
+Show trailing external-link icons for Kilo Console profile links that open in a new tab.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Make `/copy` copy the latest agent response and use `/copy-session` for session transcripts.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Always deny tool calls for title, summarize, and compaction
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Fix Amazon Bedrock models returning no output. A smithy dependency version-skew made the Bedrock event-stream decoder silently fail under the browser build condition, so every Bedrock request completed with an empty response.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Remove stray rounded corners between files in the Changes diff viewer.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Fix prompt submission in JetBrains IDEs when sending messages with file or git-change mentions.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Fix unreliable clicks on inline action buttons (Connect, OAuth, Disconnect, Enable) in the JetBrains provider, agent, and MCP settings lists so the whole button is clickable.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Fix JetBrains provider settings after OAuth/connect actions by waiting through transient backend reloads and allowing longer OAuth exchanges.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Fix upgrades to resolve Kilo CLI packages and releases instead of OpenCode packages and versions.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Identify Kilo in provider request user-agent headers instead of OpenCode.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Improve screen reader navigation and provider group controls in the model picker.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Show current-worktree sessions by default in the TUI sessions dialog and keep all/current scope toggling working when a scope has no sessions.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Handle string-form permission values when migrating bash permissions.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Show a focus outline around the JetBrains prompt input.
@@ -1,6 +0,0 @@
---
-"kilo-code": patch
-"@kilocode/cli": patch
---
-
-Add a shared model setting to hide Kilo Gateway models that may train on your prompts across Kilo clients.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Highlight the exact changed characters within modified diff lines.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Highlight shell tool commands in JetBrains chat transcripts.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Ignore Enter while IME composition is active (including Windows virtual-key 229) so composed text is not accidentally submitted from chat and sidebar inputs.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Improve markdown readability in JetBrains chat transcripts.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Hide generated read-tool payload lines from JetBrains prompt bubbles while keeping attachments and assistant tool output visible.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show JetBrains prompt attachments in one horizontal scrolling row in session history.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show a hover copy button for JetBrains session code and tool output blocks.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Show subagent tool activity inline in JetBrains session transcripts.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Add copy buttons below JetBrains session prompts and assistant responses.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show provider names on JetBrains model picker buttons for non-Kilo Gateway models.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Support pasting files and images into JetBrains chat prompts as attachments.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Fix JetBrains prompt pickers so reasoning effort opens above the button and expanded model details still allow one-click model selection.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show JetBrains prompt attachments inside the prompt bubble with previews and open embedded attachments in editor tabs.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Support sending file and image attachments from the JetBrains chat prompt.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Hide the JetBrains editor floating toolbar from the Kilo prompt input.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Limit JetBrains prompt input growth to the session while preserving scrolling for long prompts.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show Connect for available JetBrains providers without explicit auth metadata, keep only actually configured providers disconnectable, and reduce provider settings diagnostics to debug logs.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Prefer remote-safe provider OAuth methods in JetBrains and show device-code authorization details when available.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show cancellable OAuth progress in JetBrains provider settings and prevent starting another provider action while one is running.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Stop Kilo backend processes and clear JetBrains UI resources during restartless plugin unloads.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Fix copying selected text from JetBrains session views.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Support dropping files anywhere in a JetBrains chat session to add them to the prompt.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Polish session header controls and align session view icons.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Balance JetBrains shell command tooltip padding when a horizontal scrollbar is present.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Increase JetBrains todo checklist inner padding.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Use the standard transcript font for JetBrains prompt text and custom question responses.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Open embedded JetBrains message attachments in frontend-managed Kilo editor tabs with loading and connection retry states.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Replace remaining OpenCode-branded CLI and TUI copy with Kilo branding.
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-web-ui": patch
+---
+
+Use the same font stack as Kilo Cloud (Inter variable for sans, Roboto Mono variable for mono, JetBrains Mono variable as the alt-mono token) in Kilo Console. Fonts are now self-hosted as woff2 in `@kilocode/kilo-web-ui`, so Inter no longer relies on the OS having it installed.
@@ -0,0 +1,7 @@
+---
+"@kilocode/cli": minor
+"@kilocode/sdk": minor
+"@kilocode/kilo-memory": minor
+---
+
+Add opt-in project memory commands, tools, automatic capture, and public API support.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Show Agent Manager and other Git worktrees in the Kilo Console project view.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Load the bundled Atomic Chat integration without attempting to install an unpublished npm plugin.
@@ -1,6 +0,0 @@
---
-"kilo-code": patch
-"@kilocode/cli": patch
---
-
-Add an instant/thinking reasoning toggle for MiniMax M-series models, matching the existing glm/kimi/qwen behavior.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Clean up incomplete worktrees when moving a session fails to transfer its Git changes.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Announce every Settings tab by name to screen readers in compact sidebars.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Make native Plan mode follow Architect-style planning behavior while preserving Plan mode restrictions and repo-root plan files.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Organize JetBrains provider settings into connected, popular, and all-provider sections, hide custom-provider creation, and prevent Kilo Gateway disconnects from provider settings.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Offer opt-in attention sounds when sessions finish, error, or need input across the sidebar, editor tabs, and Agent Manager.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Open the selected Agent Manager worktree's pull request with Cmd/Ctrl+Shift+R.
@@ -1,33 +0,0 @@
---
-"@kilocode/cli": patch
-"kilo-code": patch
---
-
-Changes from opencode v1.14.51 to v1.15.4 upstream:
-
- Core Improvements: Clarified how to recover when the npm package is installed without its native binary.
- Core Improvements: Reduced unnecessary prompting around shell, task, and todo flows.
- Core Bugfixes: Ignored invalid exports in custom tool modules instead of failing tool loading.
- Core Bugfixes: Ignored project instruction lookup errors so sessions keep loading when project instruction discovery fails.
- Core Bugfixes: Fixed versioned event projector lookups so event replay uses the right handlers.
- Core Bugfixes: Avoid duplicate consecutive entries in prompt history.
- Core Bugfixes: Show full config validation errors during TUI startup instead of a generic failure.
- Core Bugfixes: Fixed npm installs so the CLI can recover and fetch the right native binary on more setups.
- Core Bugfixes: Fixed multiline `@` mentions in prompts.
- Core Bugfixes: Preserved custom tool metadata from Zod schemas.
- Core Bugfixes: Preserved custom tool argument descriptions in generated schemas.
- Core Bugfixes: Fixed file watching in repos where `.git` is a symlink. (@kagura-agent)
- Core Bugfixes: Fixed sync events not reaching project-scoped subscribers in injected instances.
- Core Bugfixes: Reduced wasted work when reading very large files after output truncation.
- Core Bugfixes: Fixed project-scoped bus events so file watcher and update notifications reach the right instance.
- Core Bugfixes: Fixed custom LSP servers not sending refresh events after they initialize.
- Core Bugfixes: Hid background subagent task instructions unless experimental background mode is enabled.
- TUI Improvements: Added a collapsed thinking view that can be expanded inline.
- TUI Improvements: Added pinned sessions with quick-switch slots in the session picker.
- TUI Improvements: Newly pinned sessions now stay at the end of the pinned list instead of jumping to the top.
- TUI Improvements: Made Markdown H1 headings easier to distinguish.
- TUI Bugfixes: Fixed thinking mode defaults so reasoning starts collapsed consistently.
- TUI Bugfixes: Limited session quick-switching to pinned sessions.
- TUI Bugfixes: Fixed Markdown table rendering in chat output.
- TUI Bugfixes: Fixed `kilo run --agent` resolving project-local agents.
- TUI Bugfixes: Fixed async commands losing the active instance context, which could break agent generation and GitHub-driven runs.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Restore session timestamp prefixes for generated plan filenames while preserving descriptive model-chosen names.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Polish chat tool-call previews for shell, search, and background-process output.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Prevent unreachable telemetry endpoints from blocking or failing completed CLI commands.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Keep expanded Kilo Console file diffs open while resizing the context sidebar.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Keep Kilo Console terminal sessions open when changing diff layout and other console preferences.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Prevent the bundled Atomic Chat plugin from triggering an npm installation.
@@ -1,6 +0,0 @@
---
-"@kilocode/cli": patch
-"kilo-code": patch
---
-
-Skip attention sounds when a session is manually interrupted.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Keep conversations readable across the sidebar, editor tabs, and Agent Manager by aligning messages, tool output, and the composer in one centered lane.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Enable remote control from Agent Manager without disrupting concurrent sidebar sessions, and include all open Agent Manager sessions.
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": minor
+---
+
+Support provider-aware model discovery and selection for remote Cloud sessions.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Remove the divider between agent conversations and the prompt input across extension chat views.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Render image changes in diff viewers and open images with VS Code's image preview.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Render file attachments as attachment cards in JetBrains prompts and session history.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Render JetBrains shell tool output with markdown code blocks.
@@ -1,7 +0,0 @@
---
-"@kilocode/cli": patch
-"@kilocode/sdk": patch
-"kilo-code": patch
---
-
-Restore speech input when profile details are unavailable, move transcription model selection to the Models tab, and default transcription to Whisper Large V3 Turbo.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Restore popular provider suggestions in JetBrains provider settings when provider metadata is unavailable.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Restore popular provider suggestions in the VS Code provider settings panel when provider metadata is unavailable.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Restore files to their original paths when reverting a task that moved or renamed them.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Search and switch between local sessions, worktrees, and their sessions from the Agent Manager sidebar.
@@ -1,6 +0,0 @@
---
-"@kilocode/cli": minor
-"@kilocode/kilo-indexing": minor
---
-
-Share the main codebase index with Agent Manager worktrees while indexing and searching only each worktree's changed files.
@@ -1,7 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
-"@kilocode/cli": patch
-"kilo-code": patch
---
-
-Show shared provider descriptions and provider icons in JetBrains and VS Code provider settings.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Expose the prompt-training model filter in the Kilo Console model settings.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Show line numbers in edit approval diffs, including compact sidebar views.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Open embedded transcript attachments in stable Kilo editor tabs.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Prevent concurrent Kilo processes from reusing a ChatGPT Codex refresh token.
@@ -1,5 +0,0 @@
---
-"kilo-code": minor
---
-
-Support VS Code switch links that select a Kilo model, agent, or both.
@@ -1,6 +0,0 @@
---
-"@kilocode/cli": minor
-"@kilocode/sdk": minor
---
-
-Add opt-in Unicode or emoji terminal title indicators for sessions that are working, need attention, or have finished.
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Show live session spend in the TUI sidebar while an assistant turn is still running.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Widen the sidebar chat readable lane from 78ch to 88ch so tools and content use a little more screen space.
@@ -0,0 +1,12 @@
+.git
+.opencode
+.sst
+.turbo
+.wrangler
+node_modules
+**/node_modules
+**/.output
+**/dist
+**/.turbo
+**/.vite
+**/coverage
@@ -10,15 +10,27 @@ packages/kilo-ui/tests/**/*.png filter=lfs diff=lfs merge=lfs -text
 packages/kilo-vscode/tests/**/*.png filter=lfs diff=lfs merge=lfs -text
 packages/kilo-docs/public/img/screenshot-tests/**/*.png filter=lfs diff=lfs merge=lfs -text

-# Hide non-English localization files by default in GitHub PR diffs.
+# Hide most localization files by default in GitHub PR diffs. Show English as the source
+# language and German so reviewers can catch untranslated copy-pasted English strings.
 **/i18n/*.ts linguist-generated=true
+**/i18n/**/*.ts linguist-generated=true
 **/i18n/en.ts linguist-generated=false
 **/i18n/en*.ts linguist-generated=false
+**/i18n/**/en.ts linguist-generated=false
+**/i18n/**/en*.ts linguist-generated=false
+**/i18n/de.ts linguist-generated=false
+**/i18n/de*.ts linguist-generated=false
+**/i18n/**/de.ts linguist-generated=false
+**/i18n/**/de*.ts linguist-generated=false
 **/i18n/package-nls-en.ts linguist-generated=false
+**/i18n/package-nls-de.ts linguist-generated=false
 **/i18n/index.ts linguist-generated=false
+**/i18n/**/index.ts linguist-generated=false
 **/i18n/parity.test.ts linguist-generated=false
+**/i18n/**/parity.test.ts linguist-generated=false
 packages/kilo-i18n/src/*.ts linguist-generated=true
 packages/kilo-i18n/src/en.ts linguist-generated=false
+packages/kilo-i18n/src/de.ts linguist-generated=false

 # Auto-generated CLI reference docs
 packages/kilo-docs/markdoc/partials/cli-commands-table.md linguist-generated=true
@@ -42,12 +42,46 @@ runs:
        restore-keys: |
          ${{ runner.os }}-bun-

+    # kilocode_change start
+    - name: Setup Node for native dependency builds
+      if: runner.os != 'Windows'
+      uses: actions/setup-node@v6
+      with:
+        node-version: "24"
+        package-manager-cache: false
+
+    - name: Configure node-gyp Node headers
+      if: runner.os != 'Windows'
+      id: node-gyp
+      run: |
+        node <<'NODE'
+        const fs = require("node:fs")
+        const path = require("node:path")
+
+        const exe = path.dirname(fs.realpathSync(process.execPath))
+        const dirs = [exe, path.dirname(exe)]
+        const root = dirs.find((dir) => fs.existsSync(path.join(dir, "include", "node", "node.h")))
+        if (!root) {
+          throw new Error(`Node headers not found under ${dirs.join(", ")}`)
+        }
+
+        fs.appendFileSync(process.env.GITHUB_OUTPUT, `nodedir=${root}\n`)
+        NODE
+      shell: bash
+    # kilocode_change end
+
    - name: Install setuptools for distutils compatibility
      run: python3 -m pip install setuptools || pip install setuptools || true
      shell: bash

    - name: Install dependencies
      run: |
+        # kilocode_change start
+        if [ "$RUNNER_OS" != "Windows" ]; then
+          export npm_config_nodedir="${{ steps.node-gyp.outputs.nodedir }}"
+        fi
+        # kilocode_change end
+
        # Workaround for patched peer variants
        # e.g. ./patches/ for standard-openapi
        # https://github.com/oven-sh/bun/issues/28147
@@ -41,6 +41,9 @@ jobs:
      - name: Check Effect Promise facade allowlist
        run: bun run script/check-opencode-promise-facades.ts

+      - name: Check model tool network boundary
+        run: bun run script/check-model-tool-network.ts
+
      - name: Check workflow allowlist
        run: bun run script/check-workflows.ts
      # kilocode_change end
@@ -7,9 +7,19 @@ on:
      - closed
    branches:
      - main
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: Merged JetBrains release PR number to publish
+        required: true
+        type: string
+      merge_commit:
+        description: Merge commit SHA from the reviewed release PR
+        required: true
+        type: string

 concurrency:
-  group: publish-jetbrains-pr-${{ github.event.pull_request.number }}
+  group: publish-jetbrains-pr-${{ github.event.pull_request.number || inputs.pr }}
  cancel-in-progress: false

 permissions:
@@ -23,17 +33,23 @@ jobs:
  publish:
    if: >-
      github.repository == 'Kilo-Org/kilocode' &&
-      github.event.pull_request.merged == true &&
-      startsWith(github.event.pull_request.head.ref, 'jetbrains/release/') &&
-      contains(github.event.pull_request.labels.*.name, 'jetbrains-release') &&
-      github.event.pull_request.head.repo.full_name == github.repository
+      (
+        (
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.merged == true &&
+          startsWith(github.event.pull_request.head.ref, 'jetbrains/release/') &&
+          contains(github.event.pull_request.labels.*.name, 'jetbrains-release') &&
+          github.event.pull_request.head.repo.full_name == github.repository
+        ) ||
+        github.event_name == 'workflow_dispatch'
+      )
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout merged release PR
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
-          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          ref: ${{ github.event.pull_request.merge_commit_sha || inputs.merge_commit }}

      - name: Setup Bun for validation
        uses: ./.github/actions/setup-bun
@@ -44,7 +60,7 @@ jobs:
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr }}

      - name: Save reviewed release metadata
        run: |
@@ -86,6 +102,12 @@ jobs:
        run: |
          sudo apt-get update
          sudo apt-get install -y patchelf zip
+          curl --fail --location \
+            https://ziglang.org/download/0.14.0/zig-linux-x86_64-0.14.0.tar.xz \
+            --output "$RUNNER_TEMP/zig.tar.xz"
+          echo "473ec26806133cf4d1918caf1a410f8403a13d979726a9045b421b685031a982  $RUNNER_TEMP/zig.tar.xz" | sha256sum --check --status
+          tar -xJf "$RUNNER_TEMP/zig.tar.xz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/zig-linux-x86_64-0.14.0" >> "$GITHUB_PATH"

      - name: Validate publishing secrets
        run: |
@@ -84,6 +84,16 @@ jobs:

      - uses: ./.github/actions/setup-bun

+      # kilocode_change start
+      - name: Setup Zig for Linux sandbox helpers
+        run: |
+          curl --fail --location --retry 3 \
+            https://ziglang.org/download/0.14.0/zig-linux-x86_64-0.14.0.tar.xz \
+            --output "$RUNNER_TEMP/zig.tar.xz"
+          echo "473ec26806133cf4d1918caf1a410f8403a13d979726a9045b421b685031a982  $RUNNER_TEMP/zig.tar.xz" | sha256sum --check --status
+          tar -xJf "$RUNNER_TEMP/zig.tar.xz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/zig-linux-x86_64-0.14.0" >> "$GITHUB_PATH"
+      # kilocode_change end
      - name: Build
        id: build
        run: |
@@ -179,6 +189,18 @@ jobs:
          smoke_host() {
            binary="$1"
            "$binary" --version
+            helper="$(dirname "$binary")/bwrap"
+            if [[ "${{ matrix.target }}" == linux-* ]]; then
+              test -x "$helper"
+              grep -q '^SPDX-License-Identifier: LGPL-2.0-or-later$' "$(dirname "$binary")/licenses/bubblewrap/NOTICE"
+              "$helper" --version
+              # The live user-namespace bootstrap depends on the runner's kernel/AppArmor policy
+              # (GitHub-hosted Ubuntu 24.04 sets kernel.apparmor_restrict_unprivileged_userns=1), not on
+              # the shipped artifact. The runtime probe degrades gracefully, so keep this check non-fatal.
+              "$helper" --unshare-user --disable-userns --unshare-pid --die-with-parent --new-session \
+                --ro-bind / / --dev /dev --proc /proc -- "$helper" --version \
+                || echo "unprivileged user namespaces unavailable on this runner; skipping live sandbox check"
+            fi
            root="$(mktemp -d)"
            trap 'rm -rf "$root"' RETURN
            (
@@ -212,8 +234,10 @@ jobs:
              # as optional packages and must be installed for any Bun-compiled musl binary to run.
              apk add --no-cache libstdc++ libgcc
              # kilocode_change end
-              binary="/dist/$PACKAGE/bin/kilo"
-              "$binary" --version
+              binary="/dist/$PACKAGE/bin/kilo" # kilocode_change
+              "$binary" --version # kilocode_change
+              "/dist/$PACKAGE/bin/bwrap" --version # kilocode_change
+              grep -q '\''^SPDX-License-Identifier: LGPL-2.0-or-later$'\'' "/dist/$PACKAGE/bin/licenses/bubblewrap/NOTICE" # kilocode_change
              root="$(mktemp -d)"
              trap '\''rm -rf "$root"'\'' EXIT
              unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR
@@ -288,7 +312,7 @@ jobs:
            $output = & $binary --pure models anthropic
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
            if (-not ($output -match "(?m)^anthropic/")) {
-              throw "Compiled Windows binary did not list Anthropic models from the sidecar snapshot"
+              throw "Compiled Windows binary did not list Anthropic models from the embedded snapshot"
            }
          } finally {
            Remove-Item -Recurse -Force $root -ErrorAction SilentlyContinue
--- a/Show More
+++ b/Show More