Widen the Additional Writable Paths input in the Sandboxing settings tab
so long filesystem paths are readable while typing, reusing the existing
wide-input variant without affecting the network toggle row.
Add tests for the sandbox_writable_paths behavior: real sandbox
enforcement that configured extra paths become writable while unlisted
paths and .git stay denied, and a config-scope test confirming the
setting is honored from global config only and dropped from project
config.
The coverage mode requires every documented endpoint to have a
scenario. Without this, test:httpapi fails with a missing scenario
for the new /instance/reload route.
- Block reload for retry and offline session states, not just busy
(hasActiveSession rejects any non-idle state)
- Close TOCTOU race by calling store.reload inline instead of deferring
to a pre-response handler, so the busy check and reload run in the
same effect
- Avoid double-firing reloadAfterAuthChange: only call it eagerly for
worktree sessions where the SSE directory check won't match; for the
workspace root the existing SSE handler already fires it
- Replace err: any with unknown + narrowing
- Add in-flight guard to the CLI /reload plugin to prevent overlapping
reloads from rapid double-invocation
- Remove the TaskHeader reload button (redundant with /reload slash
command, avoids chat visual regression baseline churn)
Reboots the per-directory instance, reloading config, skills, agents,
commands, and MCP prompts changed on disk without restarting the
server. Sessions and history are preserved; only the per-directory
instance caches are torn down and rebuilt.
Server: POST /instance/reload wraps the existing atomic
InstanceStore.reload path (the same one project.git.init uses). The
rebuild completes before the 200 response, so clients can refetch with
no race. Returns 409 ConflictError while a session is actively
running. Emits the existing server.instance.disposed SSE event, which
the TUI and extension already use to auto-refetch.
CLI: /reload palette command calls the endpoint; the TUI already
bootstraps on server.instance.disposed.
Extension: /reload slash command, a reload button in the task header
and settings panel, and a Kilo Code: Reload Config and Skills command
palette entry. The handler clears the command cache and reuses
reloadAfterAuthChange to re-fetch config, providers, agents, skills,
and commands. Reload targets the current session's directory so Agent
Manager worktree sessions reload their own worktree instance rather
than the workspace root.
SDK: regenerate so client.instance.reload is available to external
integrations.
- Expand leading ~ to os.homedir() in execute() before passing paths
to the sandbox profile, so ~/tmp resolves correctly.
- Strip sandbox_writable_paths from project-scoped config overlays.
A repo kilo.json must not be able to widen the sandbox beyond the
user's global config intent.
Add experimental.sandbox_writable_paths config option that allows users
to specify additional filesystem paths the sandbox permits writes to.
These paths are merged with the default writable paths when the sandbox
is active.
CLI: new config field + policy integration
VS Code: list input UI in the Sandboxing settings tab
* feat(memory): opt-in project memory — capture, recall, CLI + TUI integration
Add project memory: the standalone @kilocode/kilo-memory effect layer plus the
opencode CLI/server/TUI integration. Memory is disabled by default, so it is a
no-op until enabled (no behavior change when off).
Capture (turn-close consolidation): per-op parse salvage, secret redaction that
skips the offending op instead of aborting the batch, supersede-only auto-updates
(never model-driven deletes), correction-aware echo handling, non-LLM fallback
digests on interrupted/error turns, a shared interval throttle with idle-flush.
Recall + injection: keyword tokenizer with camelCase/compound splitting, light
stemming, and an English-first stopword filter (Unicode-aware; non-English falls
back to plain token-overlap), a live relevance floor, a budget-reserved startup
index, a session-digest catalog, and per-session prompt-cache pinning of the
injected memory block.
Surfaces: kilo_memory_save / kilo_memory_recall tools, the memory HTTP API
(contract schemas live in the package), and a status-focused TUI sidebar showing
auto-save, loaded context, and active recall, plus the /memory dialog.
* fix(memory): address PR review feedback
- C1: bump @kilocode/kilo-memory in the changeset
- C2: redact secrets before they hit the audit log (skip + salvage paths);
redact before truncating in salvageTyped so a secret straddling the
500-char cap can't leak an unmatched fragment; opText -> salvageText
- C3: de-abbreviate savedOperations, "changes" wording, ops.ts -> operations.ts
- C4: log.warn on the remaining silent-catch fallbacks (turn diff, memory
context injection, tool-visibility check)
- C5: relocate memory storage from ~/.kilo to Global.Path.data, delete the
now-dead needsDependencyInstall guard, add /memory status (root path) and
/memory edit ($VISUAL/$EDITOR + auto-rebuild)
- C6: replace the hardcoded English stopword list with corpus-derived
ubiquitous-term filtering (df across the user's own entries) and the
English suffix stemmer with suffix-tolerant term matching, so recall
noise-filtering works in any language
- C8: delete the CORRECTION_INTENT English regex; echo turns now run typed
capture (digest stays echo-gated), bounded by the interval throttle, with
the typed prompt as the language-agnostic content filter
- C9: exclude generated paths (dist/build/coverage/*.gen.*/*.map/snapshots)
from the durable-diff churn fallback so generated churn can't burn a
consolidation call
- C11: fix duplicated assert in httpapi-memory test; assert the error body
- kilo-code-bot batch: clause-boundary regex fix, byte-safe catalog
truncation, max-length guards on remember/correct/forget payloads (text,
query, key, sessionID), trim consistency in reconcile, param-shadowing
rename, missing doc entry for kilo_memory_recall, dead-code removal,
dialog UI fixes, memoryEnabledCache eviction bound, dedicated Configure
schema, recall permission renderer, covered-session pointer cap, redact
chat transcript before the consolidation model call, split configProtected
metadata from disableAlways so memory-save prompts don't show config-file
copy, drop unused MemoryService.layer provide from tool registry
- redact colon-separated low-entropy secrets too (password: hunterx),
accepting the prose false-positive tradeoff (secret: enabled) in favor of
not missing a real secret
- rename lastConsolidatedAt -> lastTypedConsolidationAt to make its narrow
scope (typed-consolidation throttle clock) explicit; regen openapi/SDK
- drop now-dead home/config fields from MemoryPaths.Host after the data-dir
relocation; add Process.splitCommand for quoted $EDITOR/$VISUAL paths with
spaces, used by /memory edit and the pre-existing Editor.open utility
* refactor(memory): shared client helpers, capture hardening, /memory UX rework
- extract client-side derivations into kilo-memory so both frontends share
one implementation: MemoryDecisions.summarize (decision-log summary),
MemoryAutosaveStatus.summarize (autosave-status semantics), and
MemoryMarkerMeta (marker wire contract encode/decode)
- match exact-key upserts via the canonical stored id (slugged key,
normalized section) so a re-emitted spaced/uppercase key updates the
entry instead of falling to fuzzy dedupe
- salvageTyped throws on valid JSON without an operations array so the
caller's fallback path records a parse error instead of a silent
zero-op success
- rename memory tool metadata files -> sources (stripPartMetadata rewrites
tool-part metadata.files assuming apply_patch records, mangling string[])
- read state instead of status for tool enabled checks; dedupe TUI helpers
(errorMessage, shared route(), Locale.number, relativeTime)
- /memory UX: bare /memory opens a help modal driven by a structured
command catalog in kilo-memory; /memory on|off become the canonical
toggle verbs (enable/disable kept as quiet aliases); /memory status opens
a clean overview dialog (root path, autosave, startup context, source
counts, index size) instead of a toast; /memory show is the single full
audit view (inspect removed)
* feat(cli): remote model catalog and WebSocket reconnection fixes
* fix(cli): preserve provider default semantics under truncation and deflake reconnect test
* fix(cli): omit provider default when per-provider truncation removes preferred model
* refactor(cli): simplify remote model catalog by removing size limits
* refactor(cli): strip remote model catalog to sanitize-and-shape only
* fix(cli): cap remote model catalog at MAX_MODELS
* fix(cli): preserve model metadata and enforce remote catalog limits
* fix(cli): omit currentModel and defaultModel when truncation drops them
* fix(cli): keep stable connection identity across reconnects
* feat(cli): include protocol version in remote session heartbeat
Agent prompts substitute with missing:"empty", which swallowed every file read error — including a deliberate out-of-scope scope block — so an escaping {file:} was silently emptied and never warned, contradicting the agent.ts catch narrative. Tag security blocks as ConfigVariableGuard.BlockedError (out-of-scope, fd swap, /proc) and, in substitute(), always reject those regardless of missing:"empty"; genuine missing/IO errors are still emptied. Now an out-of-scope {file:} in an agent prompt rejects, hits the agent catch, and records a warning. Adds guard/substitute tests for the block-under-missing:empty, missing-is-emptied, and BlockedError classification cases.
The message said file references are 'not allowed in project config', but in-root file references ARE allowed when a fileScope is supplied (the normal project path). This branch only fires when no scope was provided, so reword it to reflect that specific case and update the comment.
ConfigAgent.load() awaited ConfigVariable.substitute without a catch, so a throw (untrusted {env:} or out-of-scope {file:} in a project agent prompt) propagated through Effect.promise and failed the whole config load. Catch it, record a warning, and skip only the offending agent — mirroring the existing frontmatter-parse handling and the project config-file loops. Scope stays JSON-config-loading; the markdown substitution path (KilocodeMarkdown.substitute) remains the separate follow-up in #11889.
The read is fd-pinned, but on non-Linux the scope check realpath'd the caller's path independently of the fd, so an attacker could swap the path between open and check to validate an in-root inode while the fd pointed elsewhere. fstat the open fd and compare dev/ino against the resolved path; reject if they differ, so the inode we validate is the inode we read.
In-root absolute paths are intentionally allowed; only references that leave the root (absolute paths outside it, ../ traversal, symlinks) are rejected. Fix the docs wording and add a regression test for the in-root absolute case.
KilocodeConfigOverlay.load() propagated InvalidError from untrusted {env:}/out-of-scope {file:} substitutions through Promise.all, breaking the whole /config/overlay instead of skipping the offending file. Skip failed files (log + return {}) so the settings overlay still shows remaining config, matching the main config loader's degrade-gracefully behavior.
On non-Linux, read() validated the target via realpath but re-read by path, letting an attacker swap the file between the check and the read. Read through the already-open FileHandle (file.readFile) on every platform so the validated inode is the one read. Drops the now-unused load callback.
Move the vim modal editing engine and prompt integration out of shared
upstream files and into src/kilocode/ mirrors per the Fork Isolation Rule:
- src/kilocode/cli/cmd/tui/component/prompt/vim.ts (engine, moved)
- src/kilocode/cli/cmd/tui/component/prompt/index.tsx (new mirror with
useVim, VimModeIndicator, vimToggleCommand)
- test/kilocode/cli/cmd/tui/prompt/vim.test.ts (moved)
The shared prompt/index.tsx now calls into the mirror behind minimal
kilocode_change markers instead of inlining ~200 lines of vim logic.
plan_exit fell back to Session.plan()'s generated slug path whenever
the model omitted an explicit path, which no longer matched the
agent-chosen filename plan mode now instructs. That mismatch caused
both the wrong filename shown after "Plan is ready" and a silently
missing implement-next-session prompt (issue #11859).
plan_exit and the follow-up flow now verify the plan file exists,
recovering it via a session-timestamp glob or the plan agent's last
markdown write when the exact path is missing, and fail loudly with
actionable guidance when nothing was written.
The failure message also names an explicit path parameter that got
rejected (outside the project, or a directory), instead of silently
substituting a freshly-guessed filename that never matches what the
model actually wrote. This only affects wording of the final error:
Session.plan() and locate()'s recovery tiers still run first, so a
rejected path that's actually the canonical non-git plans dir (which
sits outside the project boundary by design) still recovers via the
timestamp glob rather than failing outright.
tool/shell.test.ts intermittently failed in CI (e.g. falls back from
terminal-only configured shell [159.79ms]) with result.output being
"(no output)". Reproduced locally at ~13% across two test cases, so
this is a real timing race rather than a one-off flake.
Bun's child_process discards buffered stdout/stderr once the child emits
"close", and our CrossSpawnSpawner attaches stream readers lazily, so
fast-exiting processes lose all output before the reader attaches. The
same path serves the live shell tool, so the test is correctly catching
a product bug.
Tap stdout/stderr into PassThroughs synchronously at spawn time, and
await the reader fiber after the process exits so scope teardown cannot
interrupt it before trailing chunks are drained.
Mark IJbema