Remove accidental `&& false` that was introduced in upstream commit
351ddeed91 ("Permission rework #6319") which disabled the filetree
from being included in the system prompt for git projects.
Upstream issue: https://github.com/anomalyco/opencode/issues/19263
Re-apply user deny rules after the ask-specific config so explicit
user denies for MCP servers are not overridden by the generated
mcpRules 'ask' defaults.
Dynamically build per-server permission rules from cfg.mcp at agent init
time using the same sanitization as mcp/index.ts. MCP tools get "ask"
permission so every call requires user approval. Rules are spread after
"*": "deny" to override via findLast() semantics.
MCP.tools() called client.listTools() for every connected server on
every agent loop iteration. With multiple servers this added hundreds
of milliseconds of overhead per step (measured ~300-750ms for remote
servers like Vercel).
Cache listTools results in a module-level Map and return them on
subsequent calls. The cache is invalidated on:
- ToolListChangedNotification from the MCP server
- Server add/connect/disconnect
- Instance dispose (config change, project switch, shutdown)
Define a readOnlyBash allowlist with deny-by-default semantics so the
Ask agent can run safe information-gathering commands (ls, cat, grep,
git log, find, jq, etc.) while blocking all write operations. Git write
subcommands (commit, push, merge, reset, etc.) are explicitly denied.
gh commands require user approval.
Mark the orchestrator agent as deprecated so users see a warning badge
in the mode switcher and agent settings, signaling they should migrate
to other agent configurations for task delegation.
Skip Kilo provider injection, fetchDefaultModel, and ACP fallback when
enabled_providers is set and doesn't include kilo. Teams using only their
own models (e.g. LiteLLM) no longer make any external calls to api.kilo.ai.
New users without config are unaffected — Kilo free still works by default.
* fix(cli): make FreeUsageLimitError non-retryable to prevent unrecoverable backoff loop
When a free model hits its usage cap, the retry loop would endlessly
retry with the same stale model reference. Switching models in the chat
selector could not break the loop because the processor captures the
model once at creation time. Making FreeUsageLimitError non-retryable
surfaces the error immediately so users can switch models and continue.
* chore(kilo-docs): update source links after removing FreeUsageLimitError URL
When the model returns finish_reason "tool-calls" but emits zero tool call
parts, the prompt loop spins indefinitely. Detect this degenerate case in the
processor after the stream completes: if finish is "tool-calls" but no tool
parts exist, convert finish to "stop" so the loop's exit checks terminate
normally.
The agent had no knowledge of ctrl+p commands, themes, or appearance
toggling, so it told users to change their terminal settings instead.
Add a TUI Settings section covering all command palette actions,
keybinds, and slash commands, and widen the skill description to
trigger on settings/appearance questions.
Plan files (.kilo/plans/*.md) were incorrectly flagged as config files
by isRelative(), causing permission prompts for the plan agent. Add
EXCLUDED_SUBDIRS to skip non-config subdirectories under config dirs.
Extend isRequest() to also check external_directory permissions against
global config paths (~/.config/kilo/), preventing 'Always allow' from
granting permanent directory access to config directories.
Edit, apply_patch, and user message summary were storing full before/after
file contents in metadata — causing sessions to balloon to 90+ MB and crash
the VS Code extension on load.
Strip before/after from edit filediff, apply_patch files[], and
summary.diffs both at write time (new data) and read time (existing data).
The subprocess restart approach did not solve the underlying Bun native
memory retention issue (oven-sh/bun#28318). Remove all restart plumbing
from rpc.ts, thread.ts, worker.ts, app.tsx, and sdk.tsx to keep the
diff clean. The diff-size and store-eviction fixes remain.
Bun Workers are threads within the same OS process — terminate() frees
the JSC context but mimalloc retains every page process-wide, so the
previous Worker-restart approach had zero effect on RSS.
Switch to Bun.spawn() with IPC which creates a separate child process.
Killing that process returns all its native memory to the OS.
The IPC relay pattern means the RPC client persists across subprocess
restarts — event listeners, fetch proxy, and SDK all continue working
without getter-indirection or rebinding.
Workaround for https://github.com/oven-sh/bun/issues/28318
Alex Alecu