Use the sticky tail-follow intent instead of momentary viewport position when deciding whether batched session updates and newly sent prompts should continue auto-scrolling. This prevents turn-close layout changes, such as modified-files cards plus progress footer removal, from cancelling an in-flight follow-to-bottom pass.
ContextDraft's default editor value reads a PropertiesComponent app
service, so constructing it requires an initialized IntelliJ Application.
As a plain unit test this only passed when another BasePlatformTestCase
initialized the app first in the same fork, making it order-dependent.
Extend BasePlatformTestCase so the Application is always available.
* fix(config): expand MCP header env refs without wiping MCP set
Project kilo.jsonc with {env:…} in MCP headers caused the whole config
load to fail since 7.4.5, silently removing every MCP. Leave {env:} literal
during untrusted text substitution, expand only remote MCP headers after
parse, and drop individual MCPs with blocked env refs instead of the full set.
Fixes#12319
* fix(config): ban {file:} during MCP header env expansion
Post-parse header expand used trusted substitute without fileScope, so a
decoy in-repo {file:} plus any {env:} could read arbitrary paths into
remote MCP headers. Expand only {env:} and reject residual {file:}.
* fix(config): ban env secret expansion in project MCP headers
Untrusted project MCP headers must not read process.env or authEnv.
Reject {env:} and {file:} per entry with a warning so sibling MCPs still load.
* fix(config): drop global MCP headers on project URL retarget
When a project config overrides a same-named global remote MCP with a
new URL and does not restate headers, do not inherit expanded secret
headers from the global entry. Also fix MCP union narrowing in tests
and stop saying "header env expansion failed" when only validating.
* fix(config): do not mutate caller's patch in mergeConfig
Shallow-copy patch before delete p.mcp so probe-then-write
updateProjectConfig paths keep mcp on the original object.
* fix(config): secure project MCP header loading
* Update packages/opencode/src/config/config.ts
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
* fix(config): secure layered MCP transitions
---------
Co-authored-by: arimu1 <19286898+arimu1@users.noreply.github.com>
Co-authored-by: Johnny Eric Amancio <johnnyeric@gmail.com>
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
Give the prompt input and the transcript user-prompt bubble a dedicated
background that defaults to the editor's code-fragment (code block) color,
via a new Kilo.Session.Prompt.Background theme key so it can be restyled
independently. Attachment strip is transparent so the prompt surface shows
through, and the prompt-bar mode/model/effort pickers now blend into that
surface when idle while keeping the standard hover fill. The transcript
bubble drops its outline unless the prompt shares the session background,
in which case it keeps the original outline for contrast.
Remove the remaining prompt attachment strip border and reuse the shared underlined file-link styling for attachment chip labels so clickable files look consistent in the transcript.
Skip prompt editor height and highlight recalculation while the editor document is in bulk update, then schedule one refresh after bulk mode exits so undo/redo cannot trigger UnexpectedBulkUpdateStateException.
Also include the local Auto-Include Editor Context setting in the Context page draft state so toggling it marks the configurable modified and Apply persists it without sending a CLI config patch.
Remove the rounded outline from compact prompt attachment chips and let the prompt attachment container own left, right, and bottom padding so attached selections align with the prompt text.
* feat(cli): answer sessionless model catalog requests
* feat(cli): add sessionless catalog changeset
* chore(cli): format remote sender files
* test(cli): simplify sessionless catalog coverage
* fix(test): extend config overlay timeout
The legacy overlay test can exceed 30 seconds on a cold Windows runner while its assertions remain valid.
kilo-maintainer[bot]