The headless path printed `${urls.local}/console` and `${urls.network}/console` without basic-auth credentials, leaving remote or display-less users unable to reach the console.
Rename `browserUrl` to `withCredentials(base, state)` so credentials are embedded into any base URL, and use it for both the printed Local/Network URLs and the in-process browser launch (which previously used `state.url` directly and now matches what the user would see if they copy/pasted the Local URL from the terminal).
Remove code paths that are unreachable in production:
- External-worktrees message flow: the webview never sends
requestExternalWorktrees, importExternalWorktree, or
importAllExternalWorktrees, and never handles the externalWorktrees
response. Drop the provider handlers, WorktreeImporter.external()/
path()/all(), WorktreeManager.listExternalWorktrees(), and the
matching message types on both sides of the protocol.
- agentManager.sessionMeta: posted by the extension after worktree
creation but never handled in the webview.
- Host.serverPort(): interface member with no callers.
- Unused imports (Disposable, ExtensionMessage, Popover), an unused
derivedFallbackBranches parameter, and two methods with no callers
or tests (SessionTerminalManager.hasTerminal/hasActiveTerminal,
SetupScriptService.getScript).
Net -316 lines. Typecheck, lint, knip, and unit tests pass.
kilo-ui's IconButton forwards label as an inert HTML attribute rather
than an accessible name, so the header action failed the WCAG
button-name check in the visual regression accessibility run. Use
aria-label, which Kobalte forwards to the button element.
The Agent Manager terminal button and Focus Terminal shortcut can now
open a terminal in the right-hand inspector next to the diff panel
instead of the VS Code integrated terminal. A split-button dropdown on
the toolbar picks the destination and persists it as the
kilo-code.new.agentManager.terminalButtonDestination setting (default:
vscode, preserving existing behavior).
The side terminal shares the existing inspector host with the diff
view, keeps running while hidden, toggles via the same button or
shortcut, and hands focus back to the chat composer when minimized.
Each context (worktree or local) gets one reusable side terminal with
its own remembered panel width.
* fix(ci): configure git identity before the docs-sync merge and classify merge failures
* fix(ci): hold the docs-sync watermark back until every PR has an outcome
* test(ci): self-check for the docs-sync failure paths
* fix(ci): isolate PR selftest concurrency from the daily docs-sync run
A provider can accept a request, return response headers, and then never
send a byte of body data. The connection-phase request timeout was cleared
as soon as headers arrived, so nothing bounded that wait and the agent turn
hung indefinitely after a tool call completed: step-finish:tool-calls was
recorded and the next step-start never arrived, with the HTTP server still
responsive.
Extend the same configured timeout deadline to the wait for the response
body's first byte. The connection-phase timer covers the fetch up to
headers; once headers arrive, the remaining deadline is handed to a
first-byte guard that aborts the request if no data arrives. After the
first byte the guard becomes a passthrough, so idle gaps inside an already
streaming response (reasoning, buffering, slow token generation) are never
touched and remain opt-in via chunkTimeout.
This is a transport-level signal (bytes on the wire, before any content)
rather than the absence of normalized AI SDK events, so it cannot fire on
long prompt processing or reasoning the way the reverted stream watchdog
did. timeout: false still disables the bound entirely.
Adds a hermetic regression test that injects a simulated stalled socket
through the provider's own fetch option via the plugin config hook, so the
SDK, Kilo's fetch wrapper, SSE parsing, the processor and the agent loop
all stay production code. The stalled request is transient, so the test
asserts the turn recovers by retrying and completing instead of freezing.
The test goes red without the fix (no retry, frozen at step-finish) and
green with it.
Refs #8656
* fix(cli): enforce permissions on shell commands the parser fails to scan
* fix(cli): fail closed on error chunks without command names, move pwsh execution test to kilo file
kirillk