The MCP tool permissions section previously only showed "allow". Document
all three levels (allow, ask, deny) with examples including wildcard
patterns and top-to-bottom evaluation order.
* fix(vscode): scope cycleAgentMode keybinding to Kilo Code panels
cmd+. and cmd+shift+. for cycleAgentMode were globally active, overriding
VS Code's built-in Quick Fix menu. Add when clauses so the keybindings
only activate when a Kilo Code view is focused (sidebar, Agent Manager,
or open-in-tab panel).
* fix(vscode): fix cycleAgentMode when clause and tab panel dispatch
Replace unreliable focusedView with sideBarFocus + custom sidebarVisible
context key for sidebar detection. Also dispatch cycleAgentMode actions
to active tab panels, which were previously missed.
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: marius-kilocode <marius@kilocode.ai>
Port the legacy KiloTaskHeader graph visualization to the new SolidJS
extension. Includes colored timeline bars (per-part type), context
window progress bar, token breakdown display, drag/wheel scroll,
active bar pulse animation, and persistent expand/collapse toggle.
Docker containers spawned by MCP servers configured with `docker run`
were not cleaned up after being stopped, causing exited containers to
accumulate and fill up Docker storage over time.
Closes#8103
Users launching a follow-up implementation session now get an explicit plan-file path and instruction to read it first, so execution stays aligned with the canonical plan even when copied plan text drifts.
- Add dompurify override (3.3.3) to force mermaid's transitive dep away from 3.3.1
- Switch kilo-gateway solid-js from pinned 1.9.10 to catalog (1.9.12) to eliminate seroval@1.3.2
* fix(agent-manager): suppress interactive prompts during background git fetch
Background git fetch operations (GitStatsPoller, worktree start point
resolution) now pass GIT_TERMINAL_PROMPT=0 and ssh -o BatchMode=yes to
prevent SSH passphrase/credential popups. Fetches silently fail when
interactive auth is required; ahead/behind counts stay stale until the
user performs an explicit git operation.
Closes#8179
* fix(agent-manager): remove background git fetch from stats poller
Background git fetch every ~120s caused SSH/credential popup dialogs for
users with interactive auth (SSH agent confirm, 1Password, YubiKey, etc.).
Remove refreshRemote entirely — ahead/behind counts now use stale local
tracking refs only, matching how other tools handle this. nonInteractiveEnv
kept for WorktreeManager.resolveStartPoint() which is user-initiated.
Closes#8179
Use the tab system to present the new BYOK Gateway workflow (VS Code tab)
alongside the legacy provider-profile setup (VS Code Legacy tab).
Updates credits-and-billing.md and using-kilo-for-free.md with consistent BYOK language.
Update hono catalog version from 4.10.7 to 4.12.12 to fix 14 advisories
including JWT algorithm confusion (GHSA-f67f-6cw9-8mq4, GHSA-3vhc-576x-3qv4),
CORS bypass, body limit bypass, XSS, cookie injection, SSE injection,
path traversal, and prototype pollution.
Add null guard for ptyID param in pty.ts to satisfy hono 4.12's stricter
return type for c.req.param().
Update simple-git from 3.31.1 to 3.35.2 in both packages/opencode and
packages/kilo-vscode to fix GHSA-r275-fr43-pm7q (blockUnsafeOperationsPlugin
bypass via case-insensitive protocol.allow config key enables RCE).
Josh Lambert