PR #7473 moved KiloNotifications from App.tsx into MessageList.tsx. Since the
agent manager reuses ChatView (which renders MessageList), KiloNotifications
now calls useNotifications() inside the agent manager — but its provider was
only in the sidebar's App.tsx. The missing context crashed the entire SolidJS
tree, rendering the agent manager blank.
Adds a regression test that statically verifies provider chain parity between
App.tsx and AgentManagerApp.tsx so this class of bug is caught at CI time.
* fix(ui): detect upward scroll to prevent auto-follow fighting keyboard navigation
* fix(ui): initialize lastScrollTop on every scrollToBottomNow call
* fix(ui): refresh lastScrollTop when scroll is near the bottom
Remove find (-exec), env (runs commands), git (hooks/aliases),
npm/yarn/pnpm/bun (postinstall scripts, run subcommand), and make
(executes Makefile recipes). Keep only commands that cannot spawn
subprocesses or execute arbitrary code.
The regex /^[a-z][a-z0-9-]*$/ does not allow underscores but the English
error message said it did. Updated to match the actual validation.
Non-English translations were already correct.
Also added a comment in ModeEditView explaining that agent() can be
undefined for modes that only exist in the config draft.
- Remove commands that can execute arbitrary code (node, python, curl,
docker, etc.) from the default bash allowlist
- Keep only read-only/informational commands, text processing, file
operations, git, package managers, compilers, and archive tools
- Handle legacy TOML config file in bash migration to detect existing
users who only have the old config format
PR #7225 adds create/edit/delete modes UI with unified config save
flow. Mark core CRUD as done, lower priority from P1 to P2, and
update the comparison tables and remaining work list.
Remove 8 plan files that covered other settings tabs (Auto Approve,
Context, Terminal, Prompts, Experiments, Provider, etc.). These are
out of scope — only the Agent Behaviour settings tab is covered.
Rewrite remaining files as precise sub-tab comparisons:
- modes-subtab-parity.md: side-by-side of legacy Modes vs new Agents
- mcp-server-creation.md: rewritten as MCP Servers sub-tab comparison
- rules-workflows-subtab-parity.md: new file for Rules & Workflows gaps
Update migration plan section to match the 4 sub-tab structure.
Simplify settings-migration.md mapping table to Agent Behaviour scope.
- Move bash permission migration from storage.ts to Config.global() so
it runs before config is consumed (fixes timing issue)
- Check all 5 global config files (config.json, kilo.json, kilo.jsonc,
opencode.json, opencode.jsonc) for existing bash permission before
migrating, and write to the highest-precedence existing file
- Add default allow-list of safe bash commands (ls, git, npm, etc.) so
users aren't prompted for common development commands
Add bash:ask to hardcoded permission defaults so new users are prompted
before shell commands execute. A storage migration preserves the existing
bash:allow behavior for existing users by writing it to their global config
if they haven't explicitly set a bash permission.
AgentBehaviourTab was 1093 lines. Now 773 lines with the edit (178 lines)
and create (147 lines) views in their own components. Each component uses
context hooks directly instead of receiving helpers via closures.
Instead of placing user before the orchestrator allowlist (which prevents
users from restricting allowed tools), keep user in the normal position
but add an explicit bash deny after user. This way:
- User can still deny orchestrator-allowed tools (e.g. webfetch)
- User cannot re-enable bash since the post-user deny wins via findLast
On Windows, path.relative() returns an absolute path when source and
target are on different drives. The ignore npm package throws a
RangeError when fed such paths. This caused 'Failed to send prompt'
when VS Code had open tabs from another drive (e.g. extension settings
in AppData while workspace is on D:).
Guard all path.relative() → ignore.ignores() call sites against
absolute results by checking path.isAbsolute() and a Windows
drive-letter regex.
Move `user` before the orchestrator-specific PermissionNext.fromConfig()
so that findLast() returns the orchestrator's rules (which appear later
in the merged array), preventing user config from re-enabling bash.
This mirrors the pattern already used by the `ask` agent.
Also removes the dead commented-out bash line since `*: deny` already
covers it.
The orchestrator mode had `bash: "allow"` in its permission ruleset, creating a
loophole where the LLM could use shell commands (sed, echo >, tee, etc.) to write
files directly instead of delegating to sub-agents via the task tool.
This is inconsistent with the orchestrator system prompt which says "Do not edit
files directly" and with how kilocode-legacy handled this (no command access at
all for orchestrator).
Removes bash from the allowed tools. The orchestrator still has read, grep, glob,
and list for lightweight codebase investigation, plus task for delegation.
Closes#7575
Removes .trim() from onChange handlers for description, prompt, and
model fields so spaces can be typed without being stripped. The create
mode form still trims on submit which is correct for one-shot actions.
All edit mode fields now write to the ConfigContext draft immediately on
change, making the Save Bar appear as soon as any edit is made. The
user navigates back via the existing back arrow in the header. Discard
is available via the Save Bar.
kilo-maintainer[bot]