* chore(deps): add minimum release age to bun install config
Set `minimumReleaseAge` to 410520 seconds (~4.75 days) to avoid
installing recently published package versions that may be unstable
or malicious.
* Update bunfig.toml
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
---------
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
* fix: catch EEXIST from recursive mkdir on Windows
fs.mkdir with { recursive: true } can still throw EEXIST on Windows
when the target directory is backed by an NTFS reparse point (OneDrive),
a directory junction, or a WSL-served path. libuv's recursive walk
doesn't treat these as regular directories, so mkdir with recursive:true
attempts to create an already-existing path segment and fails.
This adds a defensive EEXIST catch at both directory-creation origins:
- AppFileSystem.ensureDir / writeWithDirs (snapshots, config, plans)
- Encoding.write (all tool writes and edits)
No functional change on Linux/macOS where EEXIST is never thrown from
recursive mkdir.
Fixes#9618, #9755
* fix: remove extra arg from mkdirSafe call, add unit tests
* docs(kilo-docs): update auto-generated source links
Add 2 new GitHub issue references (9618, 9755) from encoding.ts
and update URL count from 84 to 86.
---------
Co-authored-by: nimgrim <nimgrim@users.noreply.github.com>
Co-authored-by: Imanol Maiztegui <imanol.mzd@gmail.com>
Switches all webview input ::placeholder rules to var(--vscode-input-placeholderForeground, var(--text-weaker)) so placeholders pick up the VS Code-native placeholder color and stay visually distinct from typed values across Settings (including indexing fields), Agent Manager dialogs, prompt input, model search and kiloclaw.
Supersedes #10085 by sylwester-liljegren.
DOMPurify 3.1.7+ removed foreignObject from default HTML integration
points, so the inner <div>/<span>/<p> Mermaid renders inside foreignObject
were stripped, leaving every shape with empty text. Restore it via
HTML_INTEGRATION_POINTS.
- Add DeepSeek to the Standard API keys list on the BYOK page (Kilo-Org/cloud#3167)
- Update auto-model-tiers architecture doc to reflect the new default of kilo-auto/free for all new users (Kilo-Org/kilocode#10151)
\S+ was greedily consuming trailing punctuation (. ! , ;) into the URL
match, causing new URL() to mutate clean ASCII URLs — e.g.
"see https://example.com." became "see https://example.com./".
Fix: strip trailing sentence punctuation before parsing, extract and
replace only the hostname (not href) to avoid adding trailing slashes to
bare origins, and restore the stripped tail afterward.
Move Kilo-specific URL normalization logic out of shared upstream files
and into a mirror file under src/kilocode/, with kilocode_change markers
at each call site per the fork merge minimization convention.
Prevent homograph attacks where visually identical Unicode characters
(e.g. Cyrillic а vs Latin a) could trick users into approving malicious
URLs in bash and webfetch permission prompts.
* fix(tool): clarify semantic_search returns snippets not file paths
The first description bullet read "Find files most relevant to the
search query using semantic search.", which led an AI agent to tell a
user that the tool returns file paths only. The tool actually returns
matching content with file paths, line ranges, and relevance scores.
Updates the first two description bullets to name the output shape
directly. No runtime change.
Closes#9767.
* test(cli): cover semantic_search description
---------
Co-authored-by: marius-kilocode <marius@kilocode.ai>
This flag currently does nothing. Presumably, it was recently added by
OpenCode upstream, but since Kilo already has the `--auto` flag, the
code that would handle `--dangerously-skip-permissions` is wired into
`--auto` instead.
Removing this useless flag avoids confusion for users.
Kirill Kalishev