Add an OS-level sandbox that confines agent writes to the project and Kilo
state directories. Currently macOS-only (via sandbox-exec/seatbelt), with
Linux, Windows, network isolation, and worktree isolation deferred to
follow-up issues (#11538, #11540, #11542, #11544, #11546, #11547).
Two enforcement layers:
- Bash tool: kernel-level seatbelt confinement via sandbox-exec
- File tools (write/edit/apply_patch): TS-level AppFileSystem layer wrapper
Both share the same configurable scope, which respects existing permission
config (external_directory allows, project sandboxes).
Opt-in via experimental.sandbox config toggle or the lock button in the
prompt input.
Add ptyConnectApiRoutes to createListenerRoutes so PTY WebSocket
connections work through the Kilo listener layer. Bump
gitlab-ai-provider to 6.8.0 and drop it from the supply-chain
quarantine exclusion list.
Realign kilocode_change comment markers to their correct lines across
tui-schema, session.sql, and several test/story files. Update ACP
auth tests to expect Kilo-branded agent name and method IDs, fix
httpapi-ui test to assert 404 for the disabled fallback UI proxy,
and point the OAuth branding test at the relocated codex plugin path.
Add new test coverage for the ACP Agent interface contract and
primaryWorktree resolution across normal repos, linked worktrees,
submodules, and paths with spaces. Refresh TUI inline-tool-wrap
snapshots and session recording fixtures to reflect current branding.
- Rename catalog.loader() to catalog.transform() in tests
- Add SessionStatus.Service dependency to tool registry layer
- Remove `loop` method from session prompt ops stubs
- Remove `onOpenChange` prop from BasicToolProps
- Update codex plugin import path to plugin/openai/codex
- Delete packages/cli scaffold (now skipped from upstream)
- Downgrade virtua to 0.42.3 and remove its patch
- Add @ai-sdk/xai@3.0.82 patch for PDF file support
Provider plugins (llmgateway, nvidia, openrouter, vercel, zenmux) now
verify the provider ID before applying attribution headers, preventing
custom-defined providers sharing the same endpoint URL from being
mutated by built-in plugin logic.
Additional changes:
- Add auth-v2.json migration path for multi-account store continuity
- Remove obsolete @ai-sdk/xai patch and ConsoleCommand registration
- Add native LLM session recordings for anthropic, openai-oauth, and zen
- Update CLI help snapshots to reflect Kilo branding
- Expand i18n with usage-exceeded dialog strings (it, nl, uk)
These auto-generated SST type files reference a root sst-env.d.ts that does not exist and import the "sst" package, which was removed in #10993. Kilo is CLI-only with no hosted platform, so these are dead artifacts. The upstream-merge tooling already lists sst-env.d.ts in skipFiles, so they won't be re-added.
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Add a validateFiles request/response round-trip between the webview and
the extension so the webview can confirm which inline code-span
candidates are real files before promoting them to clickable links.
The extension stat-checks candidate paths (new file-links.ts) and
replies with the subset that exist. Routing lives in editor-actions
alongside the other editor open actions, and openFile now falls back to
a workspace filename search (single match opens, multiple prompts) with
a "File not found" warning when a clicked path cannot be resolved.
kilo-maintainer[bot]