Redesign the Auto-Approve tab in VS Code extension settings to display
and edit granular pattern-based permission rules (object syntax).
- Add PermissionRule type to support nested objects (e.g. { bash: { "*": "deny", "git *": "allow" } })
- Granular tools (external_directory, bash, read, edit) show wildcard row, exceptions list with per-pattern dropdowns, delete buttons, and inline add input
- Simple tools show single Ask/Allow/Deny dropdown
- Group todoread/todowrite and websearch/codesearch into combined rows
- Remove "Set all permissions" card, add description subtitle
- Truncate long patterns with ellipsis and title tooltip
- Two-phase config update for exception deletion to work with patchJsonc
Add Bedrock to the list of supported BYOK providers and document
the AWS-specific credential format (JSON with accessKeyId,
secretAccessKey, and region) and required IAM permissions.
Replace plain Unicode ↓ character with the proper <Icon name="arrow-down-to-line" />
component from kilo-ui, matching the desktop app's implementation.
All 15 non-English locales in packages/app/src/i18n/ were missing 5 keys:
- dialog.model.manage.provider.toggle
- session.modeSwitch.switching
- session.modeSwitch.waiting
- session.modeSwitch.notAvailable
- session.modeSwitch.fallback
Also removes stale desktop.* keys from packages/kilo-i18n/src/bs.ts that
belong in packages/desktop/src/i18n/bs.ts (where they already exist).
The mockSessionValue in StoryProviders.tsx was missing the
respondingPermissions field added in the permission hang fix.
Components now call session.respondingPermissions() so the missing
field caused a runtime error in stories, breaking the visual regression
snapshot for bash-with-permission.
- Handle permission.replied SSE events: map them to permissionResolved
messages so cascaded and server-resolved permissions clear the webview
prompt without user action
- Remove optimistic permission removal: replace with a respondingPermissions
Set that disables buttons while awaiting server confirmation, then the
SSE-driven permissionResolved clears the prompt
- Notify webview on HTTP failure: handlePermissionResponse now posts
permissionError to re-enable buttons and show a toast instead of
silently swallowing the error
- Migrate from deprecated permission.respond to permission.reply endpoint,
fixing a missing await bug in the legacy server handler
- Recover missed permissions on reconnect and session load: new
fetchAndSendPendingPermissions() calls GET /permission after SSE
reconnects and after loadMessages, so events lost during reconnection
or while the webview was not ready are replayed
* feat(vscode): open sidebar changes in diff tab
* fix(vscode): stabilize sidebar changes review tab
* chore: update kilo-vscode visual regression baselines
* fix(vscode): harden sidebar changes tab messaging
* refactor(vscode): share review tab helpers
* fix(vscode): clear empty changes loading state
* fix(vscode): correct session state initialization
* fix(vscode): use getVSCodeAPI singleton in diff-viewer to prevent double acquireVsCodeApi call
* fix(vscode): ensure CLI connection before diff fetch and include content in diff hash
- Call connectionService.connect() in DiffViewerProvider.initialFetch() so
the panel works even if opened before any other Kilo view
- Include full diff content in hashFileDiffs instead of just after.length
to detect in-place edits that don't change line counts
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
file:// hrefs were rejected by extractFilePathFromHref (the ://
guard) and fell through to target=_blank, which does nothing in a
VS Code webview. Now they are parsed via new URL(), decoded, and
forwarded to the existing openFile handler.
- Remove onClick handleInteraction from MessageList to stop clicks breaking auto-follow
- Always resume auto-scroll when working becomes true (re-enables on follow-up messages)
- Simplify isAuto to pure time-based gating (removes fragile position-comparison race)
- Debounce stop() in handleScroll to ignore layout-induced scroll shifts
* refactor(agent-manager): decouple vscode imports into thin adapter files
Extract vscode dependencies from SessionTerminalManager, SetupScriptRunner,
and SetupScriptService into dedicated adapter files (terminal-host.ts,
task-runner.ts). Business logic modules now depend on injected interfaces
instead of importing vscode directly.
Add architecture tests enforcing the vscode import boundary with maxLines
caps that ratchet down over time, preventing coupling from creeping back.
* fix: update SessionTerminalManager test for renamed TerminalHost methods
* fix: avoid new Promise(async) anti-pattern in task-runner
Move the executeTask await before the Promise constructor so rejections
propagate correctly instead of hanging forever.
* Fix log output
The trigger has 8px left padding + 16px icon + 8px gap = 32px total.
Add padding-left: 32px to the todos list inside .vscode-session-turn-assistant
so checkboxes align with the title text in the BasicTool header.
- Add a collapsible todo section below the task title in TaskHeader
- When todos exist: shows 'N/M to-dos done' (or 'N to-dos done' when all complete)
- All-done state shows in success color
- Click to expand/collapse the full todo list with checkboxes
- Completed todos are shown with strikethrough
- Uses existing kilo-ui Icon, Checkbox components and existing CSS patterns
- Adds CSS for task-header-todos component in chat.css
- Adds i18n keys task.todos.progress and task.todos.allDone
- Adds visual regression stories: TaskHeaderWithTodos and TaskHeaderWithTodosAllDone
todowrite/todoread are suppressed by the upstream message-part renderer
(it returns null for them in PART_MAPPING['tool']). There is no dedicated
'todo dock' in the VS Code extension - the upstream suppression was inherited
without a matching UI feature.
The set is now called UPSTREAM_SUPPRESSED_TOOLS with a comment explaining:
- Why these tools are suppressed by default (upstream returns null)
- When we DO render them (pending permission or completed state)
- Why ChatView uses this set (to not block the prompt for their permissions)
HIDDEN_TOOLS is kept as an alias for backward compatibility with ChatView.
- TodoWriteWithPermission: shows todowrite pending permission inline
in the chat with the todo list widget + permission buttons
- TodoWriteCompleted: shows todo list displayed in chat after
permission is granted and todowrite completes
- Replace raw '*' pattern with a descriptive label for todo permissions:
'Update the todo list' for todowrite, 'Read the todo list' for todoread
- Hide meaningless '*' patterns in inline permission prompts (they just
mean 'all' and are confusing to users)
- Only show patterns for non-todo tools where they are meaningful
(e.g. file paths for read/edit permissions)
- Show todo tool parts (todowrite/todoread) inline in the chat when
there's a pending permission request, just like other tool permissions
- After permission is granted and the tool completes, show the todo list
UI inline in the chat so the user can see what happened
- Keep PromptInput visible when only todo permissions are pending
(since they're shown inline, not in the bottom dock)
- Use ToolRegistry to render todo tool parts directly, bypassing the
upstream PART_MAPPING["tool"] which returns null for todo tools
todowrite/todoread tool parts are intentionally hidden from the chat
message stream (they have their own dedicated dock UI). However, when
these tools require permission approval, the permission prompt was
invisible because:
1. The inline permission renderer in AssistantMessage filters out hidden
tool parts, so the attached permission prompt never renders
2. The bottom dock in ChatView only shows permissions without a tool
context (!p.tool), but todo permissions always have tool context set
Fix by extending the bottom dock filter to also show permissions for
hidden tools, so they render in the dock instead of being swallowed.
* feat(vscode): add knip dead code detection to agent-manager
Add knip to the kilo-vscode package to detect and prevent dead code in
the agent-manager. This includes:
- knip.json config scoped to src/agent-manager/ and webview-ui/agent-manager/
- CI pipeline step in test-vscode.yml to run knip on every PR
- Clean up unused exports: narrow interfaces/types to non-exported where
only used locally, remove unused re-exports from FileTree.tsx and
review-comments.ts
* expand knip scope to entire kilo-vscode package
- Widen project scope from agent-manager only to src/**/*.ts and
webview-ui/**/*.{ts,tsx}
- Exclude vendored src/services/autocomplete/** from analysis
- Enable ignoreExportsUsedInFile for component Props patterns
- Delete 4 dead files: legacy-migration barrel/messages, settings
barrel, webview telemetry util
- Trim barrel re-exports in cli-backend, telemetry, browser-automation
to only what consumers actually import through the barrel
- Unexport private helpers: getNonce, joinCspDirectives,
NEW_EXTENSION_IS_STILL_EXPERIMENTAL flag, getVSCodeAPI,
dispatchMockProviders, errorCodes
- Narrow 5 unused exported types to non-exported
Add a Kilo skill that provides comprehensive instructions for writing
Storybook stories and visual regression tests for the VS Code extension
webview UI. The skill documents the Storybook + Playwright architecture,
StoryProviders API, mock data patterns, snapshot naming conventions,
CI pipeline details, and import path references.
Josh Lambert