Kilo-Org_kilo/packages/kilo-vscode/docs/opencode-migration-plan.md

Feature Parity Plan — Kilo Code VS Code Extension (Rebuild)

Overview

This extension is a ground-up rebuild of the old Kilo Code extension using Kilo CLI as the backend. Rather than migrating the old extension's codebase, we started fresh with a Solid.js webview, a CLI server manager, and a message-based protocol between extension host and webview. This new extension lives in the Kilo monorepo.

This document tracks remaining work needed for feature parity with the old extension. Each feature links to its detailed parity requirement doc. Features sourced from the GitHub project board include issue links.

Current State Summary

The rebuild has a working foundation:

• CLI backend: server lifecycle (spawn, port detection, auth, dispose) in server-manager.ts, HTTP client with 11 endpoints in http-client.ts, SSE client with event subscriptions in sse-client.ts
• Chat UI: message list with text/tool/reasoning parts, streaming text deltas, auto-scroll in ChatView.tsx and MessageList.tsx
• Tool parts: status icons (⏳⚙️✓✕), expandable input/output sections, status-based CSS classes in Message.tsx
• Prompt input: send/abort controls in PromptInput.tsx
• Permissions: reject/once/always dialog with expandable tool details in PermissionDialog.tsx
• Sessions: create, list, select, load messages via session.tsx
• Todo pipeline: todo.updated SSE event handled through KiloProvider → webview store (no rendering UI yet)
• Auth: full device auth flow with QR code, verification code, countdown in DeviceAuthCard.tsx
• Profile: login state, balance, dashboard link, logout in ProfileView.tsx
• Session history: list with relative dates in SessionList.tsx
• Settings: 14-tab sidebar navigation shell in Settings.tsx (tabs are stubs)
• Message protocol: 28 message types in messages.ts
• Build pipeline: dual esbuild (extension + webview), CLI binary provisioning in esbuild.js and prepare-cli-binary.mjs
• View title bar button: ✅ Done — #181

---

Chat UI Feature Parity

Feature	Status	Details	Backend	Priority
Auto-Approval Controls	❌ Not started	No auto-approval toggle, scope selectors, or timeout config. Permission dialog exists but only supports per-request decisions. #171	CLI owns permissions; webview needs config UI	P1
Browser Session Controls	❌ Not started	No browser automation UI, action replay, or screenshot viewing in chat.	CLI-side (if browser tool exists) + webview	P3
Checkpoint & Task Management	❌ Not started	No checkpoint restore, navigation, or "See New Changes" diff buttons.	CLI session undo/redo/fork + extension git integration	P1
Code Block Interactions	❌ Not started	No markdown rendering, syntax highlighting, copy button, expand/collapse, or sticky buttons on code blocks. Messages render as plain text.	Webview-only	P0
Command Execution	🔨 Partial	Tool messages render but lack expandable terminal output, abort-by-PID, exit status indicators, command pattern selectors, and syntax highlighting.	CLI executes commands; webview renders output	P0
Connection State UI	❌ Not started	No loading/connecting spinner, error panel with retry, or reconnecting indicator. Chat renders even when disconnected.	Webview-only (consumes connection state)	P0
Context Menus & Tooltips	❌ Not started	No right-click context menus or hover tooltips on interactive elements.	Webview-only	P2
Diff Viewing & File Operations	❌ Not started	No diff rendering, file change stats, jump-to-file, syntax-highlighted diffs, or batch approval UI.	CLI provides diff data; webview renders	P0
File Permission Dialogs	🔨 Partial	Basic permission dialog exists (reject/once/always). Missing batch file read approval and per-file granularity. #171	CLI permission model; webview UI	P1
Follow-Up Questions	❌ Not started	No suggested reply chips, click-to-submit, auto-approval countdown, or mode indicators.	Likely extension-side generation	P2
Image Handling	❌ Not started	No image viewer, zoom/pan modal, thumbnails, file attachment support in prompt input, or image paste support.	CLI provides image data; webview renders + VS Code integration	P1
Inline Actions on Tool Messages	🔨 Partial	Tool parts render with status icons (⏳⚙️✓✕), expandable sections with input/output, and status-based CSS classes. Missing: jump-to-file links and inline action buttons.	CLI provides tool metadata; webview renders	P1
Kilo Themed Chat Session	🔨 Partial	Basic chat exists but lacks Kilo theming, markdown rendering, and visual polish. #161	Webview-only (styling/theming)	P0
Markdown Rendering	❌ Not started	Assistant messages render as plain text. No markdown parsing, code syntax highlighting, or clickable links. Blocks Code Block Interactions and Mermaid features. #161	Webview-only	P0
Mermaid Diagram Features	❌ Not started	No mermaid rendering, "Fix with AI" button, copy, or open-as-PNG. Requires markdown rendering first.	Webview-only (rendering); CLI for "Fix with AI"	P2
Message Editing & Management	❌ Not started	No inline editing, deletion, timestamp display, or redo-previous-message (up-arrow). #177	CLI session fork/undo for edit semantics	P1
Special Content Types	🔨 Partial	Reasoning blocks render (collapsible). Missing: open-markdown-preview button, MCP tool/resource rows, expandable error rows with copy.	Mixed: CLI for MCP data; webview for rendering	P1
Task Header	❌ Not started	No task header with initial prompt, cost, context size, or compaction button. #166	CLI provides cost/context data; webview renders	P0
Todo List Management	🔨 Partial	todo.updated SSE event is handled through the full pipeline: KiloProvider → webview message → session store with todos() accessor. Missing: UI component to render, display, or interact with todo items.	CLI tool or extension-side feature	P2
Toggle Thinking	🔨 Partial	Reasoning blocks render but no toggle to enable/disable thinking. Linked PR #127. #172	CLI controls thinking; webview provides toggle UI	P2

---

Non-Agent Feature Parity

Feature	Status	Details	Backend	Priority
Agent Manager	🔨 Partial	Panel exists but renders only <h1>Agent Manager</h1>. No session orchestration, parallel worktrees, or resumable sessions. #178	Extension orchestrates multiple CLI sessions	P1
Authentication & Enterprise	🔨 Partial	Device auth flow works. Missing: org feature flags, MDM policy enforcement. #160	CLI handles its auth; extension handles org/MDM	P1
Auto-Purge	❌ Not started	No scheduled cleanup of old session/task storage.	Extension-side (storage ownership TBD)	P3
Autocomplete / Ghost	❌ Not started	No inline editor completions, fill-in-the-middle, or chat-input autocomplete. #164	Extension-side (VS Code InlineCompletionProvider)	P1
Browser Automation & URL Ingestion	❌ Not started	No browser control, screenshots, or URL-to-markdown extraction.	CLI (partial); extension for browser automation	P3
Checkpoints	❌ Not started	No shadow git repo, per-task snapshots, restore UI, or diff viewing. Settings tab is a stub.	CLI (partial: session undo/redo); extension for git snapshots	P1
Cloud Task Support	❌ Not started	No cloud sync for tasks across devices. #168	Kilo cloud API + CLI; extension provides UI	P2
Code Actions	❌ Not started	No VS Code lightbulb/context menu integrations (explain, fix, improve).	Extension-side (VS Code CodeActionProvider)	P2
Code Reviews	❌ Not started	No local review mode or automated AI review of uncommitted/branch changes.	CLI (partial); extension for VS Code review UX	P2
Codebase Indexing & Semantic Search	❌ Not started	No vector indexing, semantic search, or embeddings infrastructure.	CLI has grep/glob endpoints; semantic indexing is extension or cloud	P2
Contribution Tracking	❌ Not started	No AI attribution tracking, line fingerprinting, or reporting.	Extension-side	P3
Custom Commands	❌ Not started	No slash commands, project-level command discovery, or YAML frontmatter support.	CLI has custom commands; extension provides UI entry points	P2
Deploy & Secure Surfaces	❌ Not started	No deploy workflows, managed indexing UI, or security review surfaces.	Extension-side	P3
Fast Edits	❌ Not started	No fast edit mode for quick inline code changes.	CLI fast-edit runtime; extension provides UI	P2
Git Commit Message Generation	❌ Not started	No AI commit message generation or VS Code Source Control integration. #165	Extension-side (VS Code Git API)	P2
Integrations	❌ Not started	No external system integrations (GitHub, etc.) beyond basic auth.	CLI plugin system (partial); extension for IDE hooks	P3
Kilo Gateway	🔨 Partial	Auth flow works but no explicit gateway provider selection or default model. #176	CLI handles gateway connection; extension provides config UI	P0
Localization	❌ Not started	No i18n or locale normalization. All UI is English-only.	Extension + webview; CLI locale mapping needed	P3
Marketplace	🔨 Partial	Placeholder view exists but is non-functional. No catalog, install, or update capabilities. #169	Extension-side	P2
MCP & MCP Hub	❌ Not started	No MCP configuration UI, server management, tool allowlisting, or connection status. CLI owns MCP runtime.	CLI owns MCP lifecycle; extension provides config UI	P1
Mode Switcher	❌ Not started	No mode switching UI (Code, Architect, Ask, Debug, etc.). #162	CLI manages modes; extension provides switcher UI	P2
Model Switcher	🔨 Partial	No model switching UI. In progress. #163	CLI provides model list; extension provides switcher UI	P1
Provider Configuration	❌ Not started	No provider add/edit/remove or switching UI. ProvidersTab is a stub. #175	CLI manages providers; extension provides config UI	P1
Repository Initialization	❌ Not started	No /init command support for setting up agentic engineering. #174	CLI /init endpoint; extension provides UI trigger	P3
Rules & Workflows	❌ Not started	No rules or workflow management UI. #173	CLI owns rules runtime; extension provides management UI	P3
Search & Repo Scanning	❌ Not started	No search infrastructure beyond CLI grep/glob.	CLI has grep/glob; extension may add UI	P2
Settings Sync	❌ Not started	No VS Code Settings Sync allowlist registration. Settings tabs are all stubs.	Extension-side (VS Code API)	P3
Settings UI	🔨 Partial	14-tab settings shell exists, all tabs are stubs. #170	CLI exposes config; extension provides settings forms	P1
Skills System	❌ Not started	No skill discovery, management, or hot-reload in extension.	CLI has skills runtime; extension provides packaging/UI	P2
Speech-to-Text	❌ Not started	No voice input or streaming STT.	Webview (mic capture); CLI-compatible STT optional	P3
Task History	🔨 Partial	Session list exists but lacks search, metadata, and full persistence. #167	CLI session storage; extension provides history UI	P1
Terminal / Shell Integration	❌ Not started	No VS Code terminal integration for command execution display, exit code tracking, or working directory changes.	CLI executes commands; extension provides terminal UX	P1

---

Infrastructure & Robustness

These items were identified from the JetBrains plugin analysis — patterns the JetBrains plugin implements that are missing in the VSCode extension. They primarily affect reliability and developer experience rather than feature parity.

Feature	Status	Details	Scope	Priority
SSE Auto-Reconnect	❌ Not started	SSE connection has no reconnect logic. Network hiccups, laptop sleep, or server restart kill the extension with no recovery.	Extension (SSEClient + ConnectionService)	P0
HTTP Request Timeouts	❌ Not started	HTTP client uses bare fetch() with no timeouts. Hung requests block indefinitely.	Extension (HttpClient)	P1
VSCode Error Notifications	❌ Not started	Critical errors (CLI missing, server crash) are only shown in the webview. No vscode.window.showErrorMessage() notifications.	Extension (KiloProvider)	P1
Dedicated Output Channel	❌ Not started	All logging goes to console.log mixed with other extensions. No dedicated "Kilo Code" output channel.	Extension (new logger utility)	P2

---

Pre-Production Checklist

Before publishing this extension to the VS Code Marketplace or deploying to users, verify every item below.

Security

• Review and tighten CSP — The current policy in KiloProvider._getHtmlForWebview() has several areas to audit:
  • style-src 'unsafe-inline' is broadly permissive — investigate whether nonce-based style loading is feasible now that kilo-ui styles are bundled
  • connect-src http://127.0.0.1:* http://localhost:* allows connections to any localhost port — tighten to the actual CLI server port once known at runtime
  • img-src … https: allows images from any HTTPS origin — scope to ${webview.cspSource} data: unless external images are explicitly needed
  • 'wasm-unsafe-eval' in script-src was added for shiki — confirm it is still required and document the reason
  • ws:// connections to any localhost port — same concern as connect-src
• Validate openExternal URLs — The openExternal handler passes any URL from the webview directly to vscode.env.openExternal() with no allowlist or scheme check. Restrict to https: (and possibly vscode:) schemes, or allowlist specific hosts
• Audit credential storage — CLI stores credentials as plaintext JSON with chmod 0600 (details). Evaluate whether VS Code's SecretStorage API should be used for extension-side secrets, and document the threat model for CLI-managed credentials
• Audit workspace path containment — CLI's path traversal checks are lexical only; symlinks and Windows cross-drive paths can escape the workspace boundary (details). Determine if additional hardening (realpath canonicalization) is needed before production

Reliability

• VS Code error notifications — Critical errors (CLI missing, server crash, connection lost) are only shown inside the webview (details). Users get no feedback if the webview is hidden
• Connection state UI — No loading spinner, error panel, or reconnecting indicator in the webview (details). Chat renders even when disconnected

Testing

• Test coverage — Only one test file exists (extension.test.ts). Add integration tests for: server lifecycle, SSE event routing, message send/receive, permission flow, session management
• Multi-theme visual check — Verify the webview renders correctly in at least one light theme, one dark theme, and one high-contrast theme
• Multi-platform smoke test — Test on macOS, Windows, and Linux. Particularly: CLI binary provisioning, path handling, chmod-based credential protection on Windows

Packaging & Marketplace

• Bundle size audit — With kilo-ui and its transitive dependencies (shiki, marked, katex, dompurify, etc.) now bundled, measure dist/webview.js size and verify the total .vsix package size is acceptable
• .vscodeignore review — Ensure only necessary files are included in the package (no docs/, src/, test artifacts, or development scripts)
• Marketplace metadata — Verify README.md, CHANGELOG.md, publisher name, extension icon, and package.json fields (displayName, description, categories, keywords, repository) are production-ready
• activationEvents review — Confirm the extension only activates when needed (not *), to avoid impacting VS Code startup time
• Minimum VS Code version — Verify engines.vscode in package.json matches the minimum API features actually used

Logging & Observability

• Dedicated output channel — All logging currently goes to console.log mixed with other extensions (details). Create a dedicated "Kilo Code" output channel before production
• Remove or guard verbose logging — Many console.log calls with emojis and debug detail exist in KiloProvider.ts. Gate behind a debug flag or move to the output channel at appropriate log levels

---

Implementation Notes

Architecture

• Solid.js (not React) powers the webview. JSX compiles via esbuild-plugin-solid. All webview components use Solid's reactive primitives (signals, createEffect, etc.).
• Two separate esbuild builds: extension (Node/CJS) and webview (browser/IIFE), configured in esbuild.js.
• No shared state between extension and webview. All communication is via vscode.Webview.postMessage() with typed messages defined in messages.ts.
• CLI backend owns: agent orchestration, MCP lifecycle, tool execution, search/grep/glob, session storage, permissions runtime, custom commands, skills, and fast edits.
• Extension owns: VS Code API integrations (code actions, inline completions, terminal, SCM, settings sync), webview rendering, auth mediation, and any feature not supported by CLI.

Key Differences from Old Extension

• No Task.ts or webviewMessageHandler.ts — the CLI server replaces the old in-process agent loop.
• Permissions flow through CLI's ask/reply model, not extension-side approval queues.
• Session history is CLI-managed, not stored in VS Code global state.
• MCP servers are configured and managed by the CLI, not the extension.