Remove accidental `&& false` that was introduced in upstream commit
351ddeed91 ("Permission rework #6319") which disabled the filetree
from being included in the system prompt for git projects.
Upstream issue: https://github.com/anomalyco/opencode/issues/19263
Add an inactivity watchdog to RemoteWS that force-closes and
reconnects the WebSocket when no inbound messages arrive within
a configurable timeout window (default 30s). Introduce a
heartbeat_ack inbound message type so the server can respond
to heartbeat pings, resetting the activity timer.
Re-apply user deny rules after the ask-specific config so explicit
user denies for MCP servers are not overridden by the generated
mcpRules 'ask' defaults.
Verify readOnlyBash allowlist, git write denials, gh ask rules,
disabled() behavior for edit/task/bash tools, and dynamic MCP
permission generation with server name sanitization.
Dynamically build per-server permission rules from cfg.mcp at agent init
time using the same sanitization as mcp/index.ts. MCP tools get "ask"
permission so every call requires user approval. Rules are spread after
"*": "deny" to override via findLast() semantics.
MCP.tools() called client.listTools() for every connected server on
every agent loop iteration. With multiple servers this added hundreds
of milliseconds of overhead per step (measured ~300-750ms for remote
servers like Vercel).
Cache listTools results in a module-level Map and return them on
subsequent calls. The cache is invalidated on:
- ToolListChangedNotification from the MCP server
- Server add/connect/disconnect
- Instance dispose (config change, project switch, shutdown)
Define a readOnlyBash allowlist with deny-by-default semantics so the
Ask agent can run safe information-gathering commands (ls, cat, grep,
git log, find, jq, etc.) while blocking all write operations. Git write
subcommands (commit, push, merge, reset, etc.) are explicitly denied.
gh commands require user approval.
Previous fixes in #6813 and subsequent PRs added windowsHide:true to most
spawn sites, but several call sites were missed or regressed:
- SDK server.ts (v1 + v2): kilo serve and TUI spawn
- ts-check.ts: Bun.spawn for tsc invocation
- github.ts: exec for browser open
- desktop-electron cli.ts: install script spawn and version check
- desktop-electron ipc.ts: open-path execFile
- desktop-electron apps.ts: wsl/where execFileSync calls
Without windowsHide:true, each of these subprocess invocations causes a
visible cmd.exe console window to briefly flash on Windows.
Closes#7896
Mark the orchestrator agent as deprecated so users see a warning badge
in the mode switcher and agent settings, signaling they should migrate
to other agent configurations for task delegation.
Skip Kilo provider injection, fetchDefaultModel, and ACP fallback when
enabled_providers is set and doesn't include kilo. Teams using only their
own models (e.g. LiteLLM) no longer make any external calls to api.kilo.ai.
New users without config are unaffected — Kilo free still works by default.
* fix(cli): make FreeUsageLimitError non-retryable to prevent unrecoverable backoff loop
When a free model hits its usage cap, the retry loop would endlessly
retry with the same stale model reference. Switching models in the chat
selector could not break the loop because the processor captures the
model once at creation time. Making FreeUsageLimitError non-retryable
surfaces the error immediately so users can switch models and continue.
* chore(kilo-docs): update source links after removing FreeUsageLimitError URL
When the model returns finish_reason "tool-calls" but emits zero tool call
parts, the prompt loop spins indefinitely. Detect this degenerate case in the
processor after the stream completes: if finish is "tool-calls" but no tool
parts exist, convert finish to "stop" so the loop's exit checks terminate
normally.
Reproduces the infinite loop when the model returns finish_reason: "tool-calls"
but emits zero actual tool call parts. Test 1 asserts the processor converts
finish to "stop" (currently fails). Test 2 verifies valid tool-calls flows
are preserved (passes).
The agent had no knowledge of ctrl+p commands, themes, or appearance
toggling, so it told users to change their terminal settings instead.
Add a TUI Settings section covering all command palette actions,
keybinds, and slash commands, and widen the skill description to
trigger on settings/appearance questions.
Plan files (.kilo/plans/*.md) were incorrectly flagged as config files
by isRelative(), causing permission prompts for the plan agent. Add
EXCLUDED_SUBDIRS to skip non-config subdirectories under config dirs.
Extend isRequest() to also check external_directory permissions against
global config paths (~/.config/kilo/), preventing 'Always allow' from
granting permanent directory access to config directories.
Edit, apply_patch, and user message summary were storing full before/after
file contents in metadata — causing sessions to balloon to 90+ MB and crash
the VS Code extension on load.
Strip before/after from edit filediff, apply_patch files[], and
summary.diffs both at write time (new data) and read time (existing data).
kilo-maintainer[bot]