Docker containers spawned by MCP servers configured with `docker run`
were not cleaned up after being stopped, causing exited containers to
accumulate and fill up Docker storage over time.
Closes#8103
Users launching a follow-up implementation session now get an explicit plan-file path and instruction to read it first, so execution stays aligned with the canonical plan even when copied plan text drifts.
Update hono catalog version from 4.10.7 to 4.12.12 to fix 14 advisories
including JWT algorithm confusion (GHSA-f67f-6cw9-8mq4, GHSA-3vhc-576x-3qv4),
CORS bypass, body limit bypass, XSS, cookie injection, SSE injection,
path traversal, and prototype pollution.
Add null guard for ptyID param in pty.ts to satisfy hono 4.12's stricter
return type for c.req.param().
Update simple-git from 3.31.1 to 3.35.2 in both packages/opencode and
packages/kilo-vscode to fix GHSA-r275-fr43-pm7q (blockUnsafeOperationsPlugin
bypass via case-insensitive protocol.allow config key enables RCE).
* refactor(vscode): enrich migration session data with title, directory, and time metadata
Replace plain session ID strings with structured MigrationSessionInfo objects
throughout the legacy migration pipeline. Session detection now extracts
task title, workspace directory, and timestamp from global state, providing
richer context for the migration wizard while still passing only IDs when
executing the actual migration.
* feat(vscode): add granular session progress tracking to legacy migration pipeline
Introduce MigrationSessionProgress type and SessionProgressCallback to
emit per-session phase updates during migration. The migration handler
now forwards structured progress events—including session metadata,
index, total count, and current phase—to the webview via a new
legacyMigrationSessionProgress message type, enabling the UI to display
detailed real-time feedback for each session being migrated.
* refactor(legacy-migration): extract session progress helpers and wire per-phase reporting into migrate
Move inline progress construction out of the migration loop into
dedicated buildSessionMeta and buildSessionProgress factory functions
in a new migration-session-progress module. Update the migrate function
signature to accept optional meta and progress callback, then emit
fine-grained phase events (project, session, messages, parts, skipped,
done, error) with current/count counters so callers receive incremental
feedback as each import step completes.
* feat(vscode): display per-session migration progress in MigrationWizard
Add SessionProgressState interface and wire up handling for the
legacyMigrationSessionProgress message type so the wizard UI can
render real-time phase, index, and error details for each session
being imported during legacy migration.
* refactor(migration): extract SessionMigrationProgress into dedicated component
Move SessionProgressState interface and progress rendering logic out of
MigrationWizard into a new SessionMigrationProgress component with its
own state type, step pipeline visualization, and associated CSS styles.
- Add SessionMigrationProgress.tsx with step-dot UI for project,
session, messages, and parts phases
- Replace inline SessionProgressState with exported
SessionMigrationProgressState from the new module
- Add stepper styles to migration.css with active/success dot states
- Re-export SessionMigrationProgress from the migration barrel
* fix(vscode): improve session migration progress UI and timing
Add inter-session delay to prevent rapid-fire migration requests,
fix session spinner icon to remain active while sessions are still
being processed, and restructure the progress metadata layout.
- Add 300ms delay between session migrations in migration-service
- Keep sessions group spinner active until all sessions complete
- Split meta line into separate directory, title, and date elements
with proper truncation and ellipsis handling
- Reformat date display to show time before date
- Show "Session skipped" label when phase is skipped
- Tighten spacing and padding in session progress card
* feat(migration): add post-migration summary view for session progress
Introduce a summary phase that displays aggregated migration results
after all sessions have been processed. The summary card shows counts
of imported, skipped, and errored sessions along with the last error.
- Add "summary" phase to MigrationSessionPhase union type
- Emit summary progress event with 1s delay after final session
- Create SessionMigrationCard wrapper component for shared card styling
- Create SessionMigrationSummary component with imported/skipped/errored
breakdown
- Add session-migration-summary-state module with pure reducer logic
for accumulating per-session outcomes
- Extract card border/background styles into reusable .migration-session-card
- Switch progress view to summary view when phase reaches "summary"
* refactor(legacy-migration): defer finalization to explicit client message
Move post-migration side effects (global dispose, status update,
broadcast, session refresh) out of handleStartLegacyMigration and
into a new handleFinalizeLegacyMigration handler. The webview now
sends a "finalizeLegacyMigration" message when the user clicks Done,
decoupling migration execution from completion bookkeeping.
- Extract finalization logic into handleFinalizeLegacyMigration
- Add FinalizeLegacyMigrationMessage type and wire into WebviewMessage union
- Register "finalizeLegacyMigration" case in KiloProvider message switch
- Trigger finalization from MigrationWizard handleDone before clearing data
* fix(migration): move error copy action into session summary and preserve raw error text
Remove the standalone error box and clipboard helper from
MigrationWizard, relocating the copy-to-clipboard functionality
directly into SessionMigrationSummary next to the LastError label.
Store the full error string as lastErrorRaw on SessionSummaryState
and display only the first line as the visible lastError.
- Add lastErrorRaw field to SessionSummaryState and short() helper
- Inline copy button and toast into SessionMigrationSummary component
- Add migration-session-summary__row layout style for label + button
- Remove redundant error-box markup and copySessionError from wizard
* refactor(legacy-migration): expand summary view with per-session detail lines and structured error formatting
Replace aggregate session counts with individual item listings
using a scrollable list for each category (imported, skipped,
errored). Extract formatting logic into a dedicated module
(session-migration-summary-format.ts) that handles date
formatting, single-line display, and full error report
generation for clipboard export.
- Add session-migration-summary-format.ts with line, short,
errors, and copy helpers
- Render each session item via `<For>` instead of showing counts
- Introduce scrollable __list and truncated __item CSS styles
- Change copy button to aggregate all errors rather than a
single lastErrorRaw value
* feat(migration): add full summary report export with detailed error blocks
Introduce a `report` function that compiles all migration categories
(successful, skipped, errored) into a single clipboard-exportable
document. Each error entry now includes session metadata (id,
directory, title, date) alongside the raw error message.
- Add `report()` to session-migration-summary-format.ts assembling
a complete summary with per-category blocks
- Enrich `errors()` output with structured session metadata fields
- Relocate copy button to summary header and change label to
"Copy Report" to reflect full-report semantics
- Remove error-section-scoped copy button in favor of top-level action
* style(migration): improve summary list visuals with bordered sections and empty state placeholders
Add color-coded borders per category (success, skipped, errored),
render "None" placeholders when lists are empty, apply subtle
background styling to list containers and items, and truncate
long directory paths to their last segment for readability.
* refactor(migration): inline error details beneath errored sessions and simplify report format
Replace the separate "Errors" section with per-session error detail
lines displayed directly under each errored entry. Introduce a
`detail` helper that extracts the first line of an error, render it
in a new `__entry`/`__detail` layout with truncation styling, and
consolidate the export report to embed short error text inline
rather than appending a standalone error block.
* style(migration): restyle summary lists as flat striped rows with dynamic section labels
Flatten list items by removing per-item backgrounds and border-radius
in favor of alternating zebra-stripe rows with subtle separators.
Extract an `errored` helper to produce a flat row/detail stream and
add a `label` function that appends counts and optional descriptions
to section headings. Adjust font sizes, padding, and gap values for
a denser, table-like appearance.
* feat(migration): add force-reimport support for session migration
Introduce a `force` flag on session selections that allows previously
migrated sessions to be re-imported by deleting the existing row and
reinserting with updated data. Change session selections from plain
string IDs to `MigrationSessionSelection` objects carrying `id` and
an optional `force` field. Update the backend import service to use
`onConflictDoUpdate` instead of `onConflictDoNothing`, ensuring
forced reimports fully overwrite stale session records.
* fix(ui): add selectable skipped-session list with force re-import action
Introduce checkbox selection UI for skipped sessions in the migration
summary, allowing users to pick individual or all skipped sessions and
trigger a force re-import. Wire selected IDs through `postMessage` to
the backend with the `force` flag enabled. Add custom checkbox marks,
a "select all" toggle, and supporting CSS for the new interactive
controls.
* feat(migration): introduce preparing phase and improve error handling in session migrate
Add a "preparing" step to the session migration pipeline so users see
feedback while the session is being parsed. Move `parseSession` inside
the try block and re-parse on failure so the payload is always available
for error reporting. Extract a shared `fail` helper to eliminate
duplicated error-handling logic. Update phase types, step definitions,
and progress UI across backend and webview to reflect the new phase.
* refactor(migration): simplify session migration phases and remove granular progress tracking
Collapse the project, session, messages, and parts phases into a single
"storing" phase and drop the current/count progress fields. The
fine-grained per-message and per-part counters added unnecessary
complexity without meaningful UX benefit. The pipeline now reports only
two steps—preparing and storing—making the progress UI cleaner and the
data contract between backend and webview smaller.
* fix(migration): skip already-imported sessions by checking existence before parsing
Add a pre-flight check that queries for an existing session using the
legacy ID before performing any parsing or storing work. When the session
already exists and the force flag is not set, the migration short-circuits
to a "skipped" result immediately. This avoids redundant parsing and
duplicate writes for sessions that were previously imported.
* feat(ui): add confirmation dialog before force re-importing skipped sessions
Introduce ForceReimportDialog component that warns users about
overwriting previously migrated sessions. The SessionMigrationSummary
now opens this dialog on force re-import instead of immediately
dispatching the migration message, preventing accidental data loss.
* fix(migration): correct preparing step state resolution in progress tracker
Add missing condition to return "active" state when the preparing step
matches the current preparing phase, fixing the step indicator not
highlighting correctly during the preparation stage.
* refactor(ui): lift force-reimport logic into MigrationWizard and add running state guard
Move dialog orchestration and migration message dispatch for force
re-imports from SessionMigrationSummary up to MigrationWizard, keeping
the summary component presentational via a new `onForce` callback prop.
Introduce a `running` signal to track active migrations and add a
RunningMigrationDialog that warns users before leaving mid-migration.
Extend the `MigrationResultItem` category union with "session" so
re-import results can be filtered correctly.
* fix(migration): deduplicate session entries across all categories on state update
Extract a `strip` helper that removes a session from imported, skipped,
and errored lists before re-inserting it into the target category. This
prevents the same session from appearing in multiple summary buckets
when its status changes (e.g. a re-imported session that was previously
skipped or errored) and removes the early-return guard that silently
dropped valid "done" updates for previously-seen entries.
* style(migration): increase font size and spacing in session summary list
Bump item font size from 12px to 13px, detail font size from 11px to
12px, and adjust line-height, padding, and max-height values across
summary items, details, and interactive rows for improved readability.
* refactor(migration): reorder skipped-session actions and align layout to end
Move "Force Re-import" button after the "Re-import all" checkbox in
the actions bar, switch container justification to flex-end, and
remove min-width constraint from the select-all label for a tighter
trailing alignment.
* fix(migration): hide skipped and errored sections when their lists are empty
Wrap the skipped-session and errored-session sections in `<Show>` guards
so they are only rendered when items exist, removing the "None" fallback
placeholder and eliminating empty sections from the summary view.
* test(migration): add skip-detection and force-reimport coverage for session import
Introduce three new test files covering the duplicate-detection and
force-reimport paths added to the migration pipeline:
- migrate.test.ts: verify sessions are skipped before parsing when they
already exist, and that force=true bypasses the check; update call
sites to use the new { id, force } input shape
- session-summary-state.test.ts: validate that updateSessionSummary
correctly deduplicates entries across categories on state transitions
- session-import-service.test.ts: confirm the backend service returns
skipped when a session exists without force, and deletes then
recreates when force is true
* feat(i18n): internationalize migration dialog and summary strings
Replace hardcoded English text in ForceReimportDialog,
RunningMigrationDialog, SessionMigrationSummary, and MigrationWizard
with translation keys via useLanguage().t(). Add corresponding entries
across all 19 locale files covering session summary, force-reimport,
and running-migration labels.
* fix(migration): make error payload optional and remove redundant async
Make the `payload` field optional on failure results so errors thrown
before session parsing can be reported without a payload. Remove
unnecessary `async` from the `skip` helper and conditionally spread
`payload` only when present. In the outer catch block, call `fail`
without parsing the session since the parse itself may have been the
source of the error.
* refactor(migration): remove premature success toast from force reimport
The toast notification was firing immediately when the user triggered
a force reimport, before the operation actually completed. Remove it
from the click handler so feedback can be provided by the caller once
the reimport results are known.
* fix(migration): use live session list instead of stale cached reference
Replace `cachedSessions` fallback with the canonical `sessions` array
when resolving session metadata during migration. The cached reference
could hold outdated entries after a force reimport, leading to lookups
against stale data.
* refactor(migration): remove unused error-tracking fields and dead code
Drop `lastError`/`lastErrorRaw` from `SessionSummaryState`, the
`MigrationFinalization` interface, the `short()` helper, and the
`errors()`/`copy()` summary formatters. These were introduced for
inline error display but are superseded by the full `report()`
output. Update tests to reflect the simplified state shape and add
a clarifying comment to the session-import upsert logic.
* feat(i18n): add translation keys for migration progress and summary labels
Extract shared formatting helpers into `session-migration-format.ts`
and wire all hardcoded English strings in `SessionMigrationProgress`
and `SessionMigrationSummary` through the i18n layer. New keys cover
session progress steps, the migration counter header, summary section
labels, and fallback placeholders across all 20 supported locales.
* fix(migration): correct sessions group status to reflect active progress
Override the default status resolution for the "sessions" group so it
reports "migrating" while the migration is still running and individual
entries remain pending or in-progress, preventing the group from
prematurely settling to a terminal state.
* fix: formatting
* feat(migration): track error state and finalize with completed_with_errors status
Introduce `lastMigrationHadErrors` flag on MigrationContext to capture
whether any migration entry failed or the entire process threw an
exception. Use this flag during finalization to persist a distinct
"completed_with_errors" status instead of unconditionally marking the
migration as "completed", allowing downstream UI and logic to
differentiate between clean and partial migrations.
Health check endpoints generate high-volume, low-value log entries.
Add /global/health to the skipLogging set alongside /log and
/telemetry/capture to reduce log noise.
Pass the selected organization context through to KiloClaw API
endpoints so the /kiloclaw command resolves the correct org-scoped
instance when a team is selected via /teams.
* fix(cli): guard against null theme in TUI resolveTheme and Proxy
Add null guards to prevent crashes when theme.theme is null/undefined:
- Add isValidTheme type guard with fallback to built-in kilo theme
- Wrap theme resolution memo in try/catch for resilience
- Use empty object as Proxy target instead of memo result
- Validate custom theme JSON and protect built-in theme keys
Closes#8109
* fix(cli): validate required theme keys in isValidTheme
Check for background, text, and primary keys to reject empty or
partial theme objects that would produce undefined field accesses.
* core: fix revert diff showing incorrect changes after file restore
When reverting a session, the diff was computed after files were already
reverted to their pre-change state, producing an empty or wrong diff.
By computing the diff before restoring files, the revert summary now
correctly reflects what was actually undone for the user.
* core: reduce revert diff size in DB to save storage
Full file contents were being stored in the session summary diffs,
causing unnecessary database bloat. The webview RevertBanner only
needs file path, line counts, and status — not the full diff content.
* chore(cli): add kilocode_change markers to revert diff changes
---------
Co-authored-by: Marius <marius@kilocode.ai>
* fix(cli): prevent unbounded log file growth with size-based rotation
Fix two issues causing log files to grow to 50+ GB:
1. Server middleware leaked a "started" log line for skipped endpoints
because log.time() was called unconditionally — only timer.stop()
was gated by the skipLogging flag. Restructure to early-return for
skipped paths so no logging occurs at all.
2. Log files had no size limit within a session. A long-running
kilo serve process (e.g. VS Code extension) would write a single
file indefinitely. Add rotating-file-stream (50 MB, maxFiles: 1)
to cap log file size automatically.
* fix(cli): address review feedback on log rotation
- Revert server.ts changes (handled separately in #8141)
- Add error/warning event handlers on rotating-file-stream
- Increase maxFiles from 1 to 3 for better debug headroom
- Set explicit history file path to avoid .txt side-effect
* fix(cli): revert maxFiles back to 1
maxFiles: 1 is sufficient — we only need to cap disk usage, not retain
old rotated fragments. The existing cleanup() handles session-level
file retention separately.
* fix(cli): set maxFiles to 10 for log rotation
The MCP importer was silently ignoring disabled MCP servers during import.
Now imports all configured MCPs and preserves their disabled state by
setting enabled: false in the converted config.
Closes#8096
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Imanol Maiztegui <imanol.mzd@gmail.com>
Co-authored-by: Mark IJbema <mark@kilocode.ai>
* fix(cli): inject plan file path into non-experimental plan mode prompt
The plan.txt prompt said 'STRICTLY FORBIDDEN: ANY file edits, ZERO
exceptions' without telling the agent where the plan file is. The agent
had to guess from the directory tree, often picking .kilocode/ (which
exists) over .kilo/ (which doesn't). Now the non-experimental path
computes Session.plan(), creates the directory, and injects the exact
path into the prompt — matching what the experimental plan mode already
does.
Fixes#6907
* fix(cli): use absolute plan path in prompt to match experimental mode
Addresses bot review: relative path resolves against Instance.directory,
not Instance.worktree, so subdirectory sessions would target the wrong
file. Use the absolute path from Session.plan() like the experimental
plan mode does.
* chore(cli): add kilocode_change markers to plan file path injection
* fix: keep plan follow-up sessions in the same worktree
Route follow-up question replies by the owning session and create child implementation sessions from the planning session directory so "Start new session" stays visible and runs in the right worktree.
Refs #6339
* fix: keep worktree follow-up sessions reloadable
Adopt backend-created worktree sessions by normalized directory matching and keep plan follow-up sessions as roots so Agent Manager still restores them after reload.\n\nRefs #6339
* fix(vscode): track plan follow-up sessions in the sidebar
Record pending "Start new session" replies in single-session providers so the follow-up session.created event can be adopted and opened in the sidebar and regular tabs, while Agent Manager keeps using its own worktree adoption path.\n\nRefs #6339
* fix(vscode): forward pending follow-up session events
Allow pending plan follow-up session.created events through the KiloProvider SSE filter so sidebar and tab providers can adopt and open them before the new session is tracked.\n\nRefs #6339
* fix(agent-manager): open tab for adopted follow-up sessions
Navigate to the correct worktree or add a local tab when Agent Manager adopts a backend-created follow-up session, matching the existing sessionForked behavior.\n\nRefs #6339
* refactor(vscode): unify follow-up session adoption across all providers
Remove the separate adopt-session mechanism for Agent Manager and use the same KiloProvider follow-up path that sidebar and tabs use. The sessionCreated webview handler now works regardless of the current sidebar selection, so follow-up sessions appear as local tabs everywhere.\n\nRefs #6339
* test: align followup test with parentID field from main
kilo-maintainer[bot]