Remove find (-exec), env (runs commands), git (hooks/aliases),
npm/yarn/pnpm/bun (postinstall scripts, run subcommand), and make
(executes Makefile recipes). Keep only commands that cannot spawn
subprocesses or execute arbitrary code.
- Remove commands that can execute arbitrary code (node, python, curl,
docker, etc.) from the default bash allowlist
- Keep only read-only/informational commands, text processing, file
operations, git, package managers, compilers, and archive tools
- Handle legacy TOML config file in bash migration to detect existing
users who only have the old config format
- Move bash permission migration from storage.ts to Config.global() so
it runs before config is consumed (fixes timing issue)
- Check all 5 global config files (config.json, kilo.json, kilo.jsonc,
opencode.json, opencode.jsonc) for existing bash permission before
migrating, and write to the highest-precedence existing file
- Add default allow-list of safe bash commands (ls, git, npm, etc.) so
users aren't prompted for common development commands
Add bash:ask to hardcoded permission defaults so new users are prompted
before shell commands execute. A storage migration preserves the existing
bash:allow behavior for existing users by writing it to their global config
if they haven't explicitly set a bash permission.
Instead of placing user before the orchestrator allowlist (which prevents
users from restricting allowed tools), keep user in the normal position
but add an explicit bash deny after user. This way:
- User can still deny orchestrator-allowed tools (e.g. webfetch)
- User cannot re-enable bash since the post-user deny wins via findLast
On Windows, path.relative() returns an absolute path when source and
target are on different drives. The ignore npm package throws a
RangeError when fed such paths. This caused 'Failed to send prompt'
when VS Code had open tabs from another drive (e.g. extension settings
in AppData while workspace is on D:).
Guard all path.relative() → ignore.ignores() call sites against
absolute results by checking path.isAbsolute() and a Windows
drive-letter regex.
Move `user` before the orchestrator-specific PermissionNext.fromConfig()
so that findLast() returns the orchestrator's rules (which appear later
in the merged array), preventing user config from re-enabling bash.
This mirrors the pattern already used by the `ask` agent.
Also removes the dead commented-out bash line since `*: deny` already
covers it.
The orchestrator mode had `bash: "allow"` in its permission ruleset, creating a
loophole where the LLM could use shell commands (sed, echo >, tee, etc.) to write
files directly instead of delegating to sub-agents via the task tool.
This is inconsistent with the orchestrator system prompt which says "Do not edit
files directly" and with how kilocode-legacy handled this (no command access at
all for orchestrator).
Removes bash from the allowed tools. The orchestrator still has read, grep, glob,
and list for lightweight codebase investigation, plus task for delegation.
Closes#7575
Fix .finally() clearing a newer enabling promise on disable→re-enable,
grandchild entries leaking in the children map on unsubscribe, and
permanent WS close codes leaving remote stuck enabled forever.
Add src/util/process.ts with spawn() and exec() wrappers that always set
windowsHide: true, preventing cmd.exe console popups on Windows.
Replace direct child_process imports in GitOps, shell-env, installer, and
server-manager with the new wrappers. Document the pattern in both
packages/kilo-vscode/AGENTS.md and packages/opencode/AGENTS.md so future
contributors know to use the wrappers instead of raw child_process calls.
Introduce WebSocket-based remote session relay so external clients can
subscribe to sessions, send messages, answer questions, and respond to
permissions in real time.
- RemoteWS manages the authenticated WebSocket lifecycle with reconnect
- RemoteSender dispatches inbound commands and forwards server events
- Backfill pending questions/permissions when a client subscribes
- Add question_reject command for dismissing questions remotely
- Consolidate /remote TUI command into kilo-commands
- Add session.viewed endpoint to the generated SDK
- RemoteProtocol.Preview schema for diagnostic logging
- Set process.type in mcp/index.ts so MCP SDK's StdioClientTransport
uses windowsHide:true when spawning MCP servers on Windows (the SDK
only enables this in Electron, checking 'type' in process)
- Add windowsHide:true to GitOps.ts git execFile calls
- Add windowsHide:true to marketplace installer tar execFile call
* fix(cli,vscode): prevent infinite loading in commit message generation
Add timeout-based AbortController to both server-side LLM stream (30s)
and client-side HTTP request (35s) so the SCM progress spinner cannot
hang indefinitely. Make the VS Code progress indicator cancellable so
users can abort manually. Also fix outdated test mocks that referenced
the removed getHttpClient API instead of the current SDK getClient.
* fix(cli,vscode): consume stream explicitly to prevent infinite loading
Replace `await stream.text` with `for await (chunk of stream.textStream)`
so that stream-level errors surface immediately instead of leaving the
promise hanging indefinitely. With some providers and Vercel AI SDK
versions, the `.text` promise never resolves when the underlying stream
errors out early, causing the spinner to load forever (fixes#7345).
Add a catch block that distinguishes timeout aborts from other errors
and re-throws with a human-readable message (partially addresses #6568).
In the VS Code extension, log the actual error in the getClient catch
block instead of silently discarding it.
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
The upstream merge in PR #7240 introduced channel-based database path
separation, causing non-latest/beta channels (including local dev) to
open a different DB file (e.g. kilo-local.db) instead of kilo.db. This
made all existing sessions invisible.
Remove the channel-based path logic and always use kilo.db. Also remove
the now-unused KILO_DISABLE_CHANNEL_DB flag.
Closes#7472
kilo-maintainer[bot]