When the VS Code extension host is hard-killed (crash, OOM, kill -9),
dispose() is never called and the kilo serve child process is orphaned.
Fix by using a stdin keepalive pipe: the extension keeps stdin open after
spawning the CLI. The CLI watches for EOF on stdin (only when
KILO_CLIENT=vscode) and triggers a clean shutdown. The OS closes the
write-end of the pipe on any parent death, so the CLI always exits
regardless of how the extension host terminates.
On clean dispose(), stdin is explicitly closed before sending SIGTERM,
so the shutdown path is consistent in both the crash and clean cases.
Closes#8050
Previous fixes in #6813 and subsequent PRs added windowsHide:true to most
spawn sites, but several call sites were missed or regressed:
- SDK server.ts (v1 + v2): kilo serve and TUI spawn
- ts-check.ts: Bun.spawn for tsc invocation
- github.ts: exec for browser open
- desktop-electron cli.ts: install script spawn and version check
- desktop-electron ipc.ts: open-path execFile
- desktop-electron apps.ts: wsl/where execFileSync calls
Without windowsHide:true, each of these subprocess invocations causes a
visible cmd.exe console window to briefly flash on Windows.
Closes#7896
Mark the orchestrator agent as deprecated so users see a warning badge
in the mode switcher and agent settings, signaling they should migrate
to other agent configurations for task delegation.
The subprocess restart approach did not solve the underlying Bun native
memory retention issue (oven-sh/bun#28318). Remove all restart plumbing
from rpc.ts, thread.ts, worker.ts, app.tsx, and sdk.tsx to keep the
diff clean. The diff-size and store-eviction fixes remain.
Bun Workers are threads within the same OS process — terminate() frees
the JSC context but mimalloc retains every page process-wide, so the
previous Worker-restart approach had zero effect on RSS.
Switch to Bun.spawn() with IPC which creates a separate child process.
Killing that process returns all its native memory to the OS.
The IPC relay pattern means the RPC client persists across subprocess
restarts — event listeners, fetch proxy, and SDK all continue working
without getter-indirection or rebinding.
Workaround for https://github.com/oven-sh/bun/issues/28318
Bun's JSC does not return freed native heap pages to the OS within a
single Worker lifetime. After large sessions, the only way to reclaim
that 2-3 GB of native allocator retention is to terminate the worker
and spawn a fresh one.
Workaround for https://github.com/oven-sh/bun/issues/28318
- Add getter-indirection layer so fetch/events transparently follow
worker replacement without rebuilding the TUI
- Add rejectAll() to RPC client to fail in-flight calls on termination
- Add rebindable event source that re-registers handlers on new client
- Wire /new command to fire-and-forget restart; sync layer re-bootstraps
via server.instance.disposed event from the new worker
- Guard against re-entry and skip in external server mode
User messages carry summary.diffs with full before/after file content
(the same giant strings as session_diff). The TUI never reads this
field. Strip it at both entry points (SSE handler + full sync) to
prevent multi-MB strings from accumulating in the Solid store.
The Solid store accumulated messages, parts, diffs, todos, status, and
permissions for every session visited during a TUI lifetime. Navigating
away via /new or the session list never freed the old session's data.
Add an evict() function that deletes all per-session entries from the
store maps and clears the fullSyncedSessions cache. Wire it into:
- A createEffect in app.tsx that fires when the route changes away
from a session (on() tracks prev vs current sessionID)
- The session.deleted SSE handler, which previously only removed the
session list entry but left orphaned per-session data
Defense-in-depth: destructure away before/after content from FileDiff
objects at both TUI store entry points (SSE handler + full sync). The
sidebar only reads file, additions, deletions — carrying full file content
in the Solid store is unnecessary and risks memory bloat.
- Check absolute patterns in isRequest via isAbsolute() to match the
existing metadata.filepath dual-dispatch logic, preventing a bypass
where tools pass absolute project-level config paths in patterns
- Export ConfigProtection.DISABLE_ALWAYS_KEY constant to replace the
'disableAlways' magic string across config-paths.ts, next.ts, and
permission.tsx so renames/typos are caught at compile time
Introduce WebSocket-based remote session relay so external clients can
subscribe to sessions, send messages, answer questions, and respond to
permissions in real time.
- RemoteWS manages the authenticated WebSocket lifecycle with reconnect
- RemoteSender dispatches inbound commands and forwards server events
- Backfill pending questions/permissions when a client subscribes
- Add question_reject command for dismissing questions remotely
- Consolidate /remote TUI command into kilo-commands
- Add session.viewed endpoint to the generated SDK
- RemoteProtocol.Preview schema for diagnostic logging
- kilo.ai/docs/github/#usage-examples was a 404 (page never created).
Replaced with kilo.ai/docs/automate/integrations in github.ts:245.
- vercel.link redirects to a login page that blocks bots — added to
lychee.toml exclusions.
The kilo provider always autoloads with free models and apiKey="anonymous",
causing useConnected() to return true even for first-time users without any
API key. This prevented the onboarding tip from ever appearing.
First-time users with no connected provider now see a targeted tip
on the home screen: 'Using a free model — run /connect to add your
API key'. Once a provider is connected or the user has sessions,
normal random tip behavior resumes.
Display global config path (from Global.Path.config) and project
directory in the status dialog so users can quickly verify which
config files are being loaded. Paths are shortened with ~ for
readability, matching existing TUI conventions.
* feat(vscode): add prompt history navigation with ArrowUp/ArrowDown
* fix: address review bot findings — seed order and session leak
- seedEntries now reverses chronological input so newest message is
closest to entries[0], matching navigate()'s newest-first expectation
- history.reset() called on session switch to clear stale index/draft
- Updated tests to match corrected seed order
* fix: prevent duplicate entries when append overlaps with seeded history
appendEntry now does full dedup (indexOf + splice) instead of only
checking entries[0]. This prevents the wrap-around bug where seeded
session messages create duplicates when the user re-sends the same
prompts.
* fix: guard history navigation on collapsed selection, use draft not message
- Skip history navigation when text is selected (matches desktop app's
collapsed-selection check)
- Append draft (user's typed text) instead of message (which includes
rendered review-comment markdown) to history
- Images are not affected: they're sent as attachments, not part of text
Mark IJbema