Merge pull request #11301 from Kilo-Org/console-explore-privacy-filter

feat(cli): add a privacy filter to Console model Explore
Merge pull request #11155 from Kilo-Org/fix/local-review-scale-sub-agents
2026-06-19 17:22:47 +02:00 · 2026-06-19 18:03:00 +03:00 · 2026-06-19 17:45:47 +03:00 · 2026-06-19 16:21:13 +03:00 · 2026-06-19 10:19:52 -03:00 · 2026-06-19 15:14:52 +02:00
3507 changed files with 439526 additions and 139822 deletions
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Improve the JetBrains model picker with sections, favorites, and smart filtering.
@@ -0,0 +1,7 @@
+---
+"@kilocode/cli": minor
+"@kilocode/kilo-gateway": minor
+"kilo-code": minor
+---
+
+Show a BYOK badge for Kilo Gateway models that can use an enabled personal or organization provider key.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Describe custom providers independently of their selected API protocol.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Add a JetBrains tool window action for starting new sessions and let recent sessions reopen in the side panel without duplicate views.
@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": patch
+"@kilocode/kilo-gateway": patch
+---
+
+Deny provider data collection for Kilo Gateway requests when prompt-training models are hidden.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Scale JetBrains chat transcript fonts from the editor font settings.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Keep the JetBrains model picker at the same row position when models are favorited or unfavorited.
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Add a privacy filter to the Console model explorer that hides Kilo Gateway models whose providers may use prompts for training.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show JetBrains session connection status inline above the prompt, cap expanded connection details, and keep empty sessions in the shared chat scroll area.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show detailed JetBrains session connection and configuration issues in the connection panel, and make retry recover app-side problems more reliably.
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Show docs URL in dialog when no display server is detected on headless Linux systems
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Show the docs URL in an alert dialog when the browser cannot be opened on headless systems instead of silently failing.
@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": patch
+"kilo-code": patch
+---
+
+Hide reverted provider errors so Redo controls remain visible after rewinding a session.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Match VS Code-style reasoning and tool run rendering in JetBrains chat.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Center description text and remove the fixed-width cap from the empty session panel so recent sessions can stretch naturally.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Open existing JetBrains sessions scrolled to the latest message after history loads.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Remember the JetBrains session header metrics expansion preference and show file names in read/write timeline tooltips.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Improve JetBrains history navigation with Back support and a Show History action in recent sessions.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Improve the JetBrains history panel with native tabs, independent local and cloud search, and date-grouped cloud sessions.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Improve the JetBrains mode picker with descriptions, deprecated badges, and native IntelliJ selection behavior.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show JetBrains question prompts one question at a time with aligned native option rows.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Keep the JetBrains chat transcript pinned to bottom reliably while responses stream.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show a scroll-to-bottom button when JetBrains chat sessions are scrolled away from the latest message.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Render active question and permission prompts inside the scrollable JetBrains chat transcript.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Support rebinding the JetBrains prompt Send action in the IntelliJ keymap.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show collapsible session metadata, context usage, token usage, and compaction controls in the JetBrains session header.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Add a native session history panel to the JetBrains plugin.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Control JetBrains chat transcript spacing from the session layout.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show loading immediately when opening JetBrains sessions without showing duplicate progress for new sessions.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Reduce redundant JetBrains chat scroll layout work while keeping bottom-follow behavior.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Show completed assistant steps in the JetBrains session timeline.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Support stopping active JetBrains sessions from the prompt action button.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Keep changed identifiers intact when highlighting edits within diff lines.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Accept `env` as an alias for `environment` in local MCP server configuration. Configurations using the more common `env` key (matching Docker, npm, and VS Code conventions) are now normalised on load instead of failing strict validation.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Size the JetBrains model picker from its rendered model rows instead of fixed popup dimensions.
@@ -1,5 +0,0 @@
---
-"@kilocode/cli": patch
---
-
-Show recent and favorited models in provider-specific model lists.
@@ -1,5 +0,0 @@
---
-"kilo-code": patch
---
-
-Fix token usage display to show usage for entire session
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Support reasoning effort selection and resetting JetBrains chat model overrides to the default model.
@@ -0,0 +1,7 @@
+---
+"@kilocode/cli": patch
+"@kilocode/sdk": patch
+"kilo-code": patch
+---
+
+Limit completion sounds to parent agent sessions.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Avoid failing Agent Manager startup when another extension already registered VS Code panel commands.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Align checked and unchecked reasoning picker rows in the JetBrains plugin.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Keep chat output updating after reverting and resubmitting a prompt.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Keep the JetBrains session connection status above the prompt without shifting the chat layout.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Refine JetBrains session loading UI and settings actions.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Prevent concurrent subagent updates from blanking the Agent Manager webview.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Preserve JetBrains chat scroll position when reviewing earlier session output.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Speed up Agent Manager worktree hover cards so pull request details appear and dismiss more quickly.
@@ -1,5 +0,0 @@
---
-"@kilocode/kilo-jetbrains": patch
---
-
-Avoid flickering transient loading and connection error states in JetBrains sessions.
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Widen the chat readable lane from 88ch to 98ch so conversations, tools, and diffs can use more editor space.
@@ -23,7 +23,7 @@ runs:
        fi

    - name: Setup Bun
-      uses: oven-sh/setup-bun@v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
      with:
        bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
        bun-download-url: ${{ steps.bun-url.outputs.url }}
@@ -33,8 +33,9 @@ runs:
      shell: bash
      run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"

-    - name: Cache Bun dependencies
-      uses: actions/cache@v4
+    - name: Restore Bun dependencies
+      id: bun-cache
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: ${{ steps.cache.outputs.dir }}
        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
@@ -56,3 +57,10 @@ runs:
          bun install ${{ inputs.install-flags }}
        fi
      shell: bash
+
+    - name: Save Bun dependencies
+      if: steps.bun-cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.cache.outputs.dir }}
+        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
@@ -21,7 +21,7 @@ runs:
  steps:
    - name: Create app token
      id: apptoken
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
      with:
        # kilocode_change start
        app-id: ${{ inputs['kilo-maintainer-app-id'] }}
@@ -0,0 +1,12 @@
+# kilocode_change - new file
+name: Critical-only CodeQL config
+
+query-filters:
+  - include:
+      kind:
+        - problem
+        - path-problem
+        - alert
+        - path-alert
+      tags contain: security
+      security-severity: /^(9(\.[0-9])?|10(\.0)?)$/
@@ -1,3 +1,9 @@
+## Issue
+
+<!-- Reference an existing issue with `Fixes #123`, `Closes #123`, or equivalent linked issue wording. -->
+
+Fixes #
+
 ## Context

 <!-- Brief description of WHAT you’re doing and WHY. -->
@@ -6,11 +12,13 @@

 <!--

-Some description of HOW you achieved it. Perhaps give a high level description of the program flow. Did you need to refactor something? What tradeoffs did you take? Are there things in here which you’d particularly like people to pay close attention to?
+Some description of HOW you achieved it. Perhaps give a high level description of the program flow. Did you need to refactor something? What tradeoffs did you take? Are there things in here which you’d particularly like people to pay close attention to? Keep this focused on context reviewers cannot infer from the diff; skip file-by-file summaries, placeholders, and other filler.

 -->

-## Screenshots
+## Screenshots / Video
+
+<!-- Required for visual changes. Include the relevant before/after or resulting state. -->

 | before | after |
 |---|---|
@@ -18,18 +26,49 @@ Some description of HOW you achieved it. Perhaps give a high level description o

 ## How to Test

+### Manual/local verification
+
 <!--
-
-A straightforward scenario of how to test your changes will help reviewers that are not familiar with the part of the code that you are changing but want to see it in action. This section can include a description or step-by-step instructions of how to get to the state of v2 that your change affects.
-
-A "How To Test" section can look something like this:
-
- Sign in with a user with tracks
- Activate `show_awesome_cat_gifs` feature (add `?feature.show_awesome_cat_gifs=1` to your URL)
- You should see a GIF with cats dancing
-
+Describe local CLI, extension, or docs verification. Example:
+- Opened the updated settings page and confirmed the new copy appears
 -->

+-
+
+### Reviewer test steps
+
+<!--
+Provide steps reviewers can retrace. Example:
+1. Sign in with a user with tracks
+2. Activate `show_awesome_cat_gifs` feature by adding `?feature.show_awesome_cat_gifs=1` to your URL
+3. Confirm you see a GIF with cats dancing
+-->
+
+-
+
+### Blocked checks and substitute verification
+
+<!--
+If a relevant command could not be completed, name the command, explain the blocker or failure, and describe the substitute verification performed. Example:
+- `bun run test:integration` could not complete because the required API key is unavailable; substitute verification was testing the affected flow manually in the development extension
+-->
+
+-
+
+<!--
+Every PR marked ready for review must include testing evidence. A bare "Not tested" or "N/A" answer is not sufficient. For each piece of evidence make clear if the test was executed by the agent or by a human
+
+Docs-only, config-only, and similar changes still need concrete evidence. For examples, see [Testing Evidence for Pull Requests](https://kilo.ai/docs/contributing/development-environment#testing-evidence-for-pull-requests). Draft PRs may be incomplete until marked ready for review.
+-->
+
+## Checklist
+
+- [ ] Issue linked above, or exception explained
+- [ ] Tests/verification described
+- [ ] Screenshots/video included for visual changes, or marked N/A
+- [ ] Changeset considered for user-facing changes
+- [ ] I personally reviewed the diff and can explain the changes, including any AI-assisted work.
+
 ## Get in Touch

 <!-- We'd love to have a way to chat with you about your changes if necessary. If you're in the [Kilo Code Discord](https://kilo.ai/discord), please share your handle here. -->
@@ -38,6 +38,9 @@ jobs:
          fi

      # kilocode_change start
+      - name: Check Effect Promise facade allowlist
+        run: bun run script/check-opencode-promise-facades.ts
+
      - name: Check workflow allowlist
        run: bun run script/check-workflows.ts
      # kilocode_change end
@@ -1,236 +0,0 @@
-name: close-stale-prs # kilocode_change
-
-on:
-  workflow_dispatch:
-    inputs:
-      dryRun:
-        description: "Log actions without closing PRs"
-        type: boolean
-        default: false
-  schedule:
-    - cron: "0 6 * * *"
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  close-stale-prs:
-    if: github.repository == 'Kilo-Org/kilocode'
-    runs-on: blacksmith-2vcpu-ubuntu-2404 # kilocode_change
-    timeout-minutes: 15
-    steps:
-      - name: Close inactive PRs
-        uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const DAYS_INACTIVE = 60
-            const MAX_RETRIES = 3
-
-            // Adaptive delay: fast for small batches, slower for large to respect
-            // GitHub's 80 content-generating requests/minute limit
-            const SMALL_BATCH_THRESHOLD = 10
-            const SMALL_BATCH_DELAY_MS = 1000  // 1s for daily operations (≤10 PRs)
-            const LARGE_BATCH_DELAY_MS = 2000  // 2s for backlog (>10 PRs) = ~30 ops/min, well under 80 limit
-
-            const startTime = Date.now()
-            const cutoff = new Date(Date.now() - DAYS_INACTIVE * 24 * 60 * 60 * 1000)
-            const { owner, repo } = context.repo
-            const dryRun = context.payload.inputs?.dryRun === "true"
-
-            core.info(`Dry run mode: ${dryRun}`)
-            core.info(`Cutoff date: ${cutoff.toISOString()}`)
-
-            function sleep(ms) {
-              return new Promise(resolve => setTimeout(resolve, ms))
-            }
-
-            async function withRetry(fn, description = 'API call') {
-              let lastError
-              for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-                try {
-                  const result = await fn()
-                  return result
-                } catch (error) {
-                  lastError = error
-                  const isRateLimited = error.status === 403 &&
-                    (error.message?.includes('rate limit') || error.message?.includes('secondary'))
-
-                  if (!isRateLimited) {
-                    throw error
-                  }
-
-                  // Parse retry-after header, default to 60 seconds
-                  const retryAfter = error.response?.headers?.['retry-after']
-                    ? parseInt(error.response.headers['retry-after'])
-                    : 60
-
-                  // Exponential backoff: retryAfter * 2^attempt
-                  const backoffMs = retryAfter * 1000 * Math.pow(2, attempt)
-
-                  core.warning(`${description}: Rate limited (attempt ${attempt + 1}/${MAX_RETRIES}). Waiting ${backoffMs / 1000}s before retry...`)
-
-                  await sleep(backoffMs)
-                }
-              }
-              core.error(`${description}: Max retries (${MAX_RETRIES}) exceeded`)
-              throw lastError
-            }
-
-            const query = `
-              query($owner: String!, $repo: String!, $cursor: String) {
-                repository(owner: $owner, name: $repo) {
-                  pullRequests(first: 100, states: OPEN, after: $cursor) {
-                    pageInfo {
-                      hasNextPage
-                      endCursor
-                    }
-                    nodes {
-                      number
-                      title
-                      author {
-                        login
-                      }
-                      createdAt
-                      commits(last: 1) {
-                        nodes {
-                          commit {
-                            committedDate
-                          }
-                        }
-                      }
-                      comments(last: 1) {
-                        nodes {
-                          createdAt
-                        }
-                      }
-                      reviews(last: 1) {
-                        nodes {
-                          createdAt
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            `
-
-            const allPrs = []
-            let cursor = null
-            let hasNextPage = true
-            let pageCount = 0
-
-            while (hasNextPage) {
-              pageCount++
-              core.info(`Fetching page ${pageCount} of open PRs...`)
-
-              const result = await withRetry(
-                () => github.graphql(query, { owner, repo, cursor }),
-                `GraphQL page ${pageCount}`
-              )
-
-              allPrs.push(...result.repository.pullRequests.nodes)
-              hasNextPage = result.repository.pullRequests.pageInfo.hasNextPage
-              cursor = result.repository.pullRequests.pageInfo.endCursor
-
-              core.info(`Page ${pageCount}: fetched ${result.repository.pullRequests.nodes.length} PRs (total: ${allPrs.length})`)
-
-              // Delay between pagination requests (use small batch delay for reads)
-              if (hasNextPage) {
-                await sleep(SMALL_BATCH_DELAY_MS)
-              }
-            }
-
-            core.info(`Found ${allPrs.length} open pull requests`)
-
-            const stalePrs = allPrs.filter((pr) => {
-              const dates = [
-                new Date(pr.createdAt),
-                pr.commits.nodes[0] ? new Date(pr.commits.nodes[0].commit.committedDate) : null,
-                pr.comments.nodes[0] ? new Date(pr.comments.nodes[0].createdAt) : null,
-                pr.reviews.nodes[0] ? new Date(pr.reviews.nodes[0].createdAt) : null,
-              ].filter((d) => d !== null)
-
-              const lastActivity = dates.sort((a, b) => b.getTime() - a.getTime())[0]
-
-              if (!lastActivity || lastActivity > cutoff) {
-                core.info(`PR #${pr.number} is fresh (last activity: ${lastActivity?.toISOString() || "unknown"})`)
-                return false
-              }
-
-              core.info(`PR #${pr.number} is STALE (last activity: ${lastActivity.toISOString()})`)
-              return true
-            })
-
-            if (!stalePrs.length) {
-              core.info("No stale pull requests found.")
-              return
-            }
-
-            core.info(`Found ${stalePrs.length} stale pull requests`)
-
-            // ============================================
-            // Close stale PRs
-            // ============================================
-            const requestDelayMs = stalePrs.length > SMALL_BATCH_THRESHOLD
-              ? LARGE_BATCH_DELAY_MS
-              : SMALL_BATCH_DELAY_MS
-
-            core.info(`Using ${requestDelayMs}ms delay between operations (${stalePrs.length > SMALL_BATCH_THRESHOLD ? 'large' : 'small'} batch mode)`)
-
-            let closedCount = 0
-            let skippedCount = 0
-
-            for (const pr of stalePrs) {
-              const issue_number = pr.number
-              const closeComment = `Closing this pull request because it has had no updates for more than ${DAYS_INACTIVE} days. If you plan to continue working on it, feel free to reopen or open a new PR.`
-
-              if (dryRun) {
-                core.info(`[dry-run] Would close PR #${issue_number} from ${pr.author?.login || 'unknown'}: ${pr.title}`)
-                continue
-              }
-
-              try {
-                // Add comment
-                await withRetry(
-                  () => github.rest.issues.createComment({
-                    owner,
-                    repo,
-                    issue_number,
-                    body: closeComment,
-                  }),
-                  `Comment on PR #${issue_number}`
-                )
-
-                // Close PR
-                await withRetry(
-                  () => github.rest.pulls.update({
-                    owner,
-                    repo,
-                    pull_number: issue_number,
-                    state: "closed",
-                  }),
-                  `Close PR #${issue_number}`
-                )
-
-                closedCount++
-                core.info(`Closed PR #${issue_number} from ${pr.author?.login || 'unknown'}: ${pr.title}`)
-
-                // Delay before processing next PR
-                await sleep(requestDelayMs)
-              } catch (error) {
-                skippedCount++
-                core.error(`Failed to close PR #${issue_number}: ${error.message}`)
-              }
-            }
-
-            const elapsed = Math.round((Date.now() - startTime) / 1000)
-            core.info(`\n========== Summary ==========`)
-            core.info(`Total open PRs found: ${allPrs.length}`)
-            core.info(`Stale PRs identified: ${stalePrs.length}`)
-            core.info(`PRs closed: ${closedCount}`)
-            core.info(`PRs skipped (errors): ${skippedCount}`)
-            core.info(`Elapsed time: ${elapsed}s`)
-            core.info(`=============================`)
@@ -0,0 +1,62 @@
+# kilocode_change - new file
+name: "CodeQL Kotlin"
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "packages/kilo-jetbrains/**"
+      - ".github/workflows/codeql-kotlin.yml"
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "packages/kilo-jetbrains/**"
+      - ".github/workflows/codeql-kotlin.yml"
+  schedule:
+    - cron: "29 10 * * 5"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze (java-kotlin)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: manual
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Build Java/Kotlin
+        shell: bash
+        run: ./gradlew typecheck --rerun-tasks --no-build-cache
+        working-directory: packages/kilo-jetbrains
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"
@@ -0,0 +1,81 @@
+# kilocode_change - new file
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "29 10 * * 5"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"
@@ -3,7 +3,7 @@ name: containers
 on:
  push:
    branches:
-      - dev
+      - main # kilocode_change
    paths:
      - packages/containers/**
      - .github/workflows/containers.yml
@@ -31,13 +31,13 @@ jobs:
      - uses: ./.github/actions/setup-bun

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -12,9 +12,9 @@ jobs:
      contents: read
      issues: write
    steps:
-      - uses: actions/checkout@v6 # kilocode_change
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Close non-compliant issues and PRs after 2 hours
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const { data: items } = await github.rest.issues.listForRepo({
@@ -6,28 +6,25 @@ on:

 jobs:
  check-duplicates:
-    if: false # kilocode_change - disabled: not needed in kilocode repo
+    if: github.event.action == 'opened'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6 # kilocode_change
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 1

      - uses: ./.github/actions/setup-bun

-      # kilocode_change start
-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
-      # kilocode_change end
+      - name: Install opencode
+        run: curl -fsSL https://kilo.ai/install | bash

      - name: Check duplicates and compliance
        env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          KILO_PERMISSION: |
            {
@@ -38,7 +35,7 @@ jobs:
              "webfetch": "deny"
            }
        run: |
-          kilo run -m "kilo/anthropic/claude-haiku-4.5" "A new issue has been created:
+          opencode run -m opencode/claude-sonnet-4-6 "A new issue has been created:

          Issue number: ${{ github.event.issue.number }}

@@ -128,23 +125,18 @@ jobs:
      issues: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6 # kilocode_change
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 1

      - uses: ./.github/actions/setup-bun

-      # kilocode_change start
-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
-      # kilocode_change end
+      - name: Install opencode
+        run: curl -fsSL https://kilo.ai/install | bash

      - name: Recheck compliance
        env:
-          # kilocode_change start
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          # kilocode_change end
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          KILO_PERMISSION: |
            {
@@ -155,7 +147,7 @@ jobs:
              "webfetch": "deny"
            }
        run: |
-          kilo run -m "kilo/anthropic/claude-haiku-4.5" "Issue #${{ github.event.issue.number }} was previously flagged as non-compliant and has been edited.
+          opencode run -m opencode/claude-sonnet-4-6 "Issue #${{ github.event.issue.number }} was previously flagged as non-compliant and has been edited.

          Lookup this issue with gh issue view ${{ github.event.issue.number }}.

@@ -12,6 +12,6 @@ jobs:
    runs-on: depot-ubuntu-24.04
    steps:
      - name: Send nicely-formatted embed to Discord
-        uses: SethCohen/github-releases-to-discord@v1
+        uses: SethCohen/github-releases-to-discord@24d166886aee4646d448c8a389ff9e1ebcab3682 # v1.20.0
        with:
          webhook_url: ${{ secrets.DISCORD_WEBHOOK }}
@@ -12,7 +12,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 1

@@ -78,7 +78,7 @@ jobs:
      issues: write
    steps:
      - name: Add Contributor Label
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const isPR = !!context.payload.pull_request;
@@ -12,7 +12,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Check PR standards
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const pr = context.payload.pull_request;
@@ -159,7 +159,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Check PR template compliance
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const pr = context.payload.pull_request;
@@ -16,7 +16,7 @@ jobs:
  publish:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
        with:
          fetch-depth: 0

@@ -16,7 +16,7 @@ jobs:
  release:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

@@ -29,7 +29,7 @@ jobs:
          fi

      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 1

@@ -15,7 +15,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup Bun
        uses: ./.github/actions/setup-bun
@@ -29,7 +29,7 @@ jobs:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup Bun
        uses: ./.github/actions/setup-bun
@@ -10,7 +10,7 @@ jobs:
    name: Release Zed Extension
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

@@ -6,33 +6,31 @@ on:

 jobs:
  triage:
-    if: github.repository == 'Kilo-Org/kilocode'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6 # kilocode_change
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 1

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

-      - name: Setup Kilo
-        uses: ./.github/actions/setup-kilo
+      - name: Install opencode
+        run: curl -fsSL https://kilo.ai/install | bash

      - name: Triage issue
        env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
-          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          ISSUE_TITLE: ${{ github.event.issue.title }}
          ISSUE_BODY: ${{ github.event.issue.body }}
        run: |
-          kilo run --agent triage "The following issue was just opened, triage it:
+          opencode run --agent triage "The following issue was just opened, triage it:

          Title: $ISSUE_TITLE

@@ -0,0 +1,366 @@
+# kilocode_change - new file
+name: kilo-auto-close
+
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: "Log actions without closing items"
+        type: boolean
+        default: true
+  schedule:
+    - cron: "0 6 * * *"
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  close:
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - name: Close inactive PRs and issues
+        uses: actions/github-script@v8
+        env:
+          KILO_AUTO_CLOSE_ENABLED: ${{ vars.KILO_AUTO_CLOSE_ENABLED }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const PR_DAYS_INACTIVE = 30
+            const ISSUE_DAYS_INACTIVE = 60
+            const MAX_RETRIES = 3
+
+            // Adaptive delay: fast for small batches, slower for large to respect
+            // GitHub's 80 content-generating requests/minute limit
+            const SMALL_BATCH_THRESHOLD = 10
+            const SMALL_BATCH_DELAY_MS = 1000  // 1s for daily operations (≤10 items)
+            const LARGE_BATCH_DELAY_MS = 2000  // 2s for backlog (>10 items) = ~30 ops/min, well under 80 limit
+
+            const startTime = Date.now()
+            const prCutoff = new Date(Date.now() - PR_DAYS_INACTIVE * 24 * 60 * 60 * 1000)
+            const issueCutoff = new Date(Date.now() - ISSUE_DAYS_INACTIVE * 24 * 60 * 60 * 1000)
+            const { owner, repo } = context.repo
+            const dryRunInput = context.payload.inputs?.dryRun
+            const enabled = process.env.KILO_AUTO_CLOSE_ENABLED === "true"
+            const dryRun = dryRunInput === undefined
+              ? !enabled
+              : dryRunInput !== "false"
+
+            core.info(`Dry run mode: ${dryRun}`)
+            core.info(`PR cutoff date: ${prCutoff.toISOString()}`)
+            core.info(`Issue cutoff date: ${issueCutoff.toISOString()}`)
+
+            function sleep(ms) {
+              return new Promise(resolve => setTimeout(resolve, ms))
+            }
+
+            async function withRetry(fn, description = 'API call') {
+              let lastError
+              for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+                try {
+                  const result = await fn()
+                  return result
+                } catch (error) {
+                  lastError = error
+                  const isRateLimited = error.status === 403 &&
+                    (error.message?.includes('rate limit') || error.message?.includes('secondary'))
+
+                  if (!isRateLimited) {
+                    throw error
+                  }
+
+                  if (attempt === MAX_RETRIES - 1) {
+                    break
+                  }
+
+                  // Parse retry-after header, default to 60 seconds
+                  const retryAfter = error.response?.headers?.['retry-after']
+                    ? parseInt(error.response.headers['retry-after'])
+                    : 60
+
+                  // Exponential backoff: retryAfter * 2^attempt
+                  const backoffMs = retryAfter * 1000 * Math.pow(2, attempt)
+
+                  core.warning(`${description}: Rate limited (attempt ${attempt + 1}/${MAX_RETRIES}). Waiting ${backoffMs / 1000}s before retry...`)
+
+                  await sleep(backoffMs)
+                }
+              }
+              core.error(`${description}: Max retries (${MAX_RETRIES}) exceeded`)
+              throw lastError
+            }
+
+            const query = `
+              query($owner: String!, $repo: String!, $cursor: String) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequests(first: 100, states: OPEN, after: $cursor) {
+                    pageInfo {
+                      hasNextPage
+                      endCursor
+                    }
+                    nodes {
+                      number
+                      title
+                      author {
+                        login
+                      }
+                      createdAt
+                      commits(last: 1) {
+                        nodes {
+                          commit {
+                            committedDate
+                          }
+                        }
+                      }
+                      comments(last: 1) {
+                        nodes {
+                          createdAt
+                        }
+                      }
+                      reviews(last: 1) {
+                        nodes {
+                          createdAt
+                        }
+                      }
+                      reviewThreads(last: 100) {
+                        nodes {
+                          comments(last: 1) {
+                            nodes {
+                              createdAt
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            `
+
+            const allPrs = []
+            let cursor = null
+            let hasNextPage = true
+            let pageCount = 0
+
+            while (hasNextPage) {
+              pageCount++
+              core.info(`Fetching page ${pageCount} of open PRs...`)
+
+              const result = await withRetry(
+                () => github.graphql(query, { owner, repo, cursor }),
+                `GraphQL page ${pageCount}`
+              )
+
+              allPrs.push(...result.repository.pullRequests.nodes)
+              hasNextPage = result.repository.pullRequests.pageInfo.hasNextPage
+              cursor = result.repository.pullRequests.pageInfo.endCursor
+
+              core.info(`Page ${pageCount}: fetched ${result.repository.pullRequests.nodes.length} PRs (total: ${allPrs.length})`)
+
+              // Delay between pagination requests (use small batch delay for reads)
+              if (hasNextPage) {
+                await sleep(SMALL_BATCH_DELAY_MS)
+              }
+            }
+
+            core.info(`Found ${allPrs.length} open pull requests`)
+
+            function entry(source, date) {
+              if (!date) return null
+
+              return { source, date: new Date(date) }
+            }
+
+            function latest(items) {
+              return items.filter(Boolean).sort((a, b) => b.date.getTime() - a.date.getTime())[0]
+            }
+
+            const stalePrs = allPrs.flatMap((pr) => {
+              const activity = latest([
+                entry("created", pr.createdAt),
+                entry("commit", pr.commits.nodes[0]?.commit.committedDate),
+                entry("comment", pr.comments.nodes[0]?.createdAt),
+                entry("review", pr.reviews.nodes[0]?.createdAt),
+                ...pr.reviewThreads.nodes.map((t) => entry("review comment", t.comments.nodes[0]?.createdAt)),
+              ])
+              const text = activity
+                ? `${activity.date.toISOString()} via ${activity.source}`
+                : "unknown"
+
+              if (!activity || activity.date > prCutoff) {
+                core.info(`PR #${pr.number} is fresh (last activity: ${text})`)
+                return []
+              }
+
+              core.info(`PR #${pr.number} is STALE (last activity: ${text})`)
+              return [{ ...pr, activity }]
+            })
+
+            core.info(`Found ${stalePrs.length} stale pull requests`)
+
+            const prDelayMs = stalePrs.length > SMALL_BATCH_THRESHOLD
+              ? LARGE_BATCH_DELAY_MS
+              : SMALL_BATCH_DELAY_MS
+
+            core.info(`Using ${prDelayMs}ms delay between PR operations (${stalePrs.length > SMALL_BATCH_THRESHOLD ? 'large' : 'small'} batch mode)`)
+
+            let closedPrCount = 0
+            let skippedPrCount = 0
+
+            for (const pr of stalePrs) {
+              const issue_number = pr.number
+              const closeComment = `To stay organized pull requests are automatically closed after ${PR_DAYS_INACTIVE} days of inactivity. If the pull request is still relevant please reopen it or create a fresh new one.`
+
+              if (dryRun) {
+                core.info(`[dry-run] Would close PR #${issue_number} from ${pr.author?.login || 'unknown'} (last activity: ${pr.activity.date.toISOString()} via ${pr.activity.source}): ${pr.title}`)
+                continue
+              }
+
+              try {
+                // Add comment
+                await withRetry(
+                  () => github.rest.issues.createComment({
+                    owner,
+                    repo,
+                    issue_number,
+                    body: closeComment,
+                  }),
+                  `Comment on PR #${issue_number}`
+                )
+
+                // Close PR
+                await withRetry(
+                  () => github.rest.pulls.update({
+                    owner,
+                    repo,
+                    pull_number: issue_number,
+                    state: "closed",
+                  }),
+                  `Close PR #${issue_number}`
+                )
+
+                closedPrCount++
+                core.info(`Closed PR #${issue_number} from ${pr.author?.login || 'unknown'} (last activity: ${pr.activity.date.toISOString()} via ${pr.activity.source}): ${pr.title}`)
+
+                // Delay before processing next PR
+                await sleep(prDelayMs)
+              } catch (error) {
+                skippedPrCount++
+                core.error(`Failed to close PR #${issue_number}: ${error.message}`)
+              }
+            }
+
+            let page = 1
+            let stop = false
+            const staleIssues = []
+
+            while (!stop) {
+              core.info(`Fetching page ${page} of open issues...`)
+
+              const result = await withRetry(
+                () => github.rest.issues.listForRepo({
+                  owner,
+                  repo,
+                  state: "open",
+                  sort: "updated",
+                  direction: "asc",
+                  per_page: 100,
+                  page,
+                }),
+                `Issues page ${page}`
+              )
+
+              if (!result.data.length) {
+                break
+              }
+
+              core.info(`Page ${page}: fetched ${result.data.length} issues`)
+
+              for (const issue of result.data) {
+                const updated = new Date(issue.updated_at)
+
+                if (updated >= issueCutoff) {
+                  core.info(`Found fresh issue/PR #${issue.number} (${updated.toISOString()}), stopping issue scan`)
+                  stop = true
+                  break
+                }
+
+                if (issue.pull_request) {
+                  core.info(`Skipping PR #${issue.number} in issue scan`)
+                  continue
+                }
+
+                staleIssues.push({ ...issue, activity: updated })
+              }
+
+              if (!stop) {
+                page++
+                await sleep(SMALL_BATCH_DELAY_MS)
+              }
+            }
+
+            core.info(`Found ${staleIssues.length} stale issues`)
+
+            const issueDelayMs = staleIssues.length > SMALL_BATCH_THRESHOLD
+              ? LARGE_BATCH_DELAY_MS
+              : SMALL_BATCH_DELAY_MS
+
+            core.info(`Using ${issueDelayMs}ms delay between issue operations (${staleIssues.length > SMALL_BATCH_THRESHOLD ? 'large' : 'small'} batch mode)`)
+
+            let closedIssueCount = 0
+            let skippedIssueCount = 0
+
+            for (const issue of staleIssues) {
+              const closeComment = `To stay organized issues are automatically closed after ${ISSUE_DAYS_INACTIVE} days of no activity. If the issue is still relevant please reopen it or create a fresh new one.`
+
+              if (dryRun) {
+                core.info(`[dry-run] Would close issue #${issue.number} (last activity: ${issue.activity.toISOString()} via updated): ${issue.title}`)
+                continue
+              }
+
+              try {
+                await withRetry(
+                  () => github.rest.issues.createComment({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    body: closeComment,
+                  }),
+                  `Comment on issue #${issue.number}`
+                )
+
+                await withRetry(
+                  () => github.rest.issues.update({
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    state: "closed",
+                    state_reason: "not_planned",
+                  }),
+                  `Close issue #${issue.number}`
+                )
+
+                closedIssueCount++
+                core.info(`Closed issue #${issue.number} (last activity: ${issue.activity.toISOString()} via updated): ${issue.title}`)
+
+                await sleep(issueDelayMs)
+              } catch (error) {
+                skippedIssueCount++
+                core.error(`Failed to close issue #${issue.number}: ${error.message}`)
+              }
+            }
+
+            const elapsed = Math.round((Date.now() - startTime) / 1000)
+            core.info(`\n========== Summary ==========`)
+            core.info(`Total open PRs found: ${allPrs.length}`)
+            core.info(`Stale PRs identified: ${stalePrs.length}`)
+            core.info(`PRs closed: ${closedPrCount}`)
+            core.info(`PRs skipped (errors): ${skippedPrCount}`)
+            core.info(`Stale issues identified: ${staleIssues.length}`)
+            core.info(`Issues closed: ${closedIssueCount}`)
+            core.info(`Issues skipped (errors): ${skippedIssueCount}`)
+            core.info(`Elapsed time: ${elapsed}s`)
+            core.info(`=============================`)
@@ -21,10 +21,10 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@v34
+        uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34

      - name: Evaluate flake outputs (all systems)
        run: |
@@ -42,10 +42,10 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@v34
+        uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34

      - name: Compute node_modules hash
        id: hash
@@ -0,0 +1,64 @@
+# kilocode_change - new file
+name: prepare-jetbrains-release
+
+on:
+  workflow_dispatch:
+    inputs:
+      kind:
+        description: "Release kind"
+        required: true
+        type: choice
+        options:
+          - rc
+          - stable
+      version:
+        description: "Version, e.g. 7.3.13-rc.1 or 7.3.13"
+        required: true
+        type: string
+      from_tag:
+        description: "Optional previous tag for changelog range"
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: prepare-jetbrains-release-${{ inputs.version }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    if: github.repository == 'Kilo-Org/kilocode'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      - name: Setup Git Committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          kilo-maintainer-app-id: ${{ secrets.KILO_MAINTAINER_APP_ID }}
+          kilo-maintainer-app-secret: ${{ secrets.KILO_MAINTAINER_APP_SECRET }}
+
+      - name: Create release tag and PR
+        run: |
+          args=(--kind "$KIND" --version "$VERSION")
+          if [[ -n "$FROM_TAG" ]]; then
+            args+=(--from-tag "$FROM_TAG")
+          fi
+          bun script/jetbrains-release-pr.ts "${args[@]}"
+        env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+          GH_REPO: ${{ github.repository }}
+          KIND: ${{ inputs.kind }}
+          VERSION: ${{ inputs.version }}
+          FROM_TAG: ${{ inputs.from_tag }}
@@ -2,27 +2,65 @@
 name: publish-jetbrains

 on:
-  push:
-    tags:
-      - "jetbrains/*"
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main

 concurrency:
-  group: publish-jetbrains-${{ github.ref }}
+  group: publish-jetbrains-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: false

 permissions:
  contents: write
+  pull-requests: read

 env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

 jobs:
  publish:
-    if: github.repository == 'Kilo-Org/kilocode'
+    if: >-
+      github.repository == 'Kilo-Org/kilocode' &&
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, 'jetbrains/release/') &&
+      contains(github.event.pull_request.labels.*.name, 'jetbrains-release') &&
+      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Checkout merged release PR
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+
+      - name: Setup Bun for validation
+        uses: ./.github/actions/setup-bun
+
+      - name: Validate release PR and tag
+        id: release
+        run: bun script/jetbrains-release-validate.ts --pr "$PR_NUMBER"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+
+      - name: Save reviewed release metadata
+        run: |
+          cp packages/kilo-jetbrains/CHANGELOG.md "$RUNNER_TEMP/jetbrains-CHANGELOG.md"
+          cp packages/kilo-jetbrains/gradle.properties "$RUNNER_TEMP/jetbrains-gradle.properties"
+
+      - name: Checkout release tag
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.release.outputs.tag }}
+
+      - name: Restore reviewed release metadata
+        run: |
+          cp "$RUNNER_TEMP/jetbrains-CHANGELOG.md" packages/kilo-jetbrains/CHANGELOG.md
+          cp "$RUNNER_TEMP/jetbrains-gradle.properties" packages/kilo-jetbrains/gradle.properties

      - name: Setup Node
        uses: actions/setup-node@v4
@@ -32,6 +70,9 @@ jobs:
      - name: Setup Bun
        uses: ./.github/actions/setup-bun

+      - name: Install dependencies
+        run: bun install
+
      - name: Setup Java
        uses: actions/setup-java@v4
        with:
@@ -46,40 +87,6 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y patchelf zip

-      - name: Validate version tag
-        id: version
-        run: |
-          tag="$GITHUB_REF_NAME"
-          if [[ "$tag" != jetbrains/v* ]]; then
-            echo "Unsupported tag '$tag'. Expected jetbrains/v<version>." >&2
-            exit 1
-          fi
-
-          version="${tag#jetbrains/v}"
-          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
-            {
-              echo "version=$version"
-              echo "kind=rc"
-              echo "marketplace_channel=eap"
-              echo "cli_channel=rc"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            {
-              echo "version=$version"
-              echo "kind=stable"
-              echo "marketplace_channel=default"
-              echo "cli_channel=latest"
-            } >> "$GITHUB_OUTPUT"
-            echo "Stable JetBrains Marketplace publishing is implemented but intentionally disabled; use an rc tag such as jetbrains/v7.0.1-rc.1." >&2
-            exit 1
-          fi
-
-          echo "Unsupported JetBrains plugin version '$version'. Expected jetbrains/vx.y.z-rc.n or jetbrains/vx.y.z." >&2
-          exit 1
-
      - name: Validate publishing secrets
        run: |
          missing=0
@@ -100,8 +107,8 @@ jobs:
        working-directory: packages/kilo-jetbrains
        run: bun script/build.ts --production --prepare-cli
        env:
-          KILO_VERSION: ${{ steps.version.outputs.version }}
-          KILO_CHANNEL: ${{ steps.version.outputs.cli_channel }}
+          KILO_VERSION: ${{ steps.release.outputs.version }}
+          KILO_CHANNEL: ${{ steps.release.outputs.cli_channel }}
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}

@@ -109,13 +116,26 @@ jobs:
        working-directory: packages/kilo-jetbrains
        run: ./gradlew verifyPlugin -Pproduction=true -Pkilo.channel="$CHANNEL"
        env:
-          CHANNEL: ${{ steps.version.outputs.marketplace_channel }}
+          VERSION: ${{ steps.release.outputs.version }}
+          CHANNEL: ${{ steps.release.outputs.marketplace_channel }}
+
+      - name: Render release notes
+        working-directory: packages/kilo-jetbrains
+        run: |
+          if ! grep -Fq "## [$VERSION]" CHANGELOG.md; then
+            echo "Missing packages/kilo-jetbrains/CHANGELOG.md entry for $VERSION. Review and merge a release PR before publishing." >&2
+            exit 1
+          fi
+          ./gradlew getChangelog --project-version "$VERSION" --no-header --no-empty-sections --output-file=build/release-notes.md
+        env:
+          VERSION: ${{ steps.release.outputs.version }}

      - name: Publish to JetBrains Marketplace
        working-directory: packages/kilo-jetbrains
        run: ./gradlew publishPlugin -Pproduction=true -Pkilo.channel="$CHANNEL"
        env:
-          CHANNEL: ${{ steps.version.outputs.marketplace_channel }}
+          VERSION: ${{ steps.release.outputs.version }}
+          CHANNEL: ${{ steps.release.outputs.marketplace_channel }}
          JETBRAINS_MARKETPLACE_TOKEN: ${{ secrets.JETBRAINS_MARKETPLACE_TOKEN }}
          JETBRAINS_CERTIFICATE_CHAIN: ${{ secrets.JETBRAINS_CERTIFICATE_CHAIN }}
          JETBRAINS_PRIVATE_KEY: ${{ secrets.JETBRAINS_PRIVATE_KEY }}
@@ -145,23 +165,30 @@ jobs:

      - name: Upload to GitHub Release
        run: |
-          tag="$GITHUB_REF_NAME"
+          tag="$TAG"
          title="JetBrains $VERSION"
-          notes="JetBrains plugin $VERSION."
+          flags=(--title "$title" --notes-file "$NOTES")
+          if [[ "$KIND" == "rc" ]]; then
+            flags+=(--prerelease)
+          fi
          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release upload "$tag" "$ARCHIVE" --clobber --repo "$GITHUB_REPOSITORY"
+            gh release edit "$tag" "${flags[@]}" --repo "$GITHUB_REPOSITORY"
            exit 0
          fi
-          gh release create "$tag" "$ARCHIVE" --title "$title" --notes "$notes" --prerelease --repo "$GITHUB_REPOSITORY"
+          gh release create "$tag" "$ARCHIVE" "${flags[@]}" --repo "$GITHUB_REPOSITORY"
        env:
          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.version.outputs.version }}
+          TAG: ${{ steps.release.outputs.tag }}
+          VERSION: ${{ steps.release.outputs.version }}
+          KIND: ${{ steps.release.outputs.kind }}
          ARCHIVE: ${{ steps.archive.outputs.path }}
+          NOTES: packages/kilo-jetbrains/build/release-notes.md

      - name: Upload workflow artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
-          name: kilo-jetbrains-${{ steps.version.outputs.version }}
+          name: kilo-jetbrains-${{ steps.release.outputs.version }}
          path: packages/kilo-jetbrains/build/distributions/*.zip
          if-no-files-found: ignore
@@ -118,8 +118,187 @@ jobs:
    outputs:
      version: ${{ needs.version.outputs.version }}

-  build-vscode:
+  # kilocode_change start - execute supported Unix CLI binaries before packaging VSIX artifacts
+  validate-cli-unix:
+    name: Validate CLI (${{ matrix.target }})
    needs: build-cli
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: darwin-arm64
+            runner: macos-15
+            uname: arm64
+            package: "@kilocode/cli-darwin-arm64"
+            mode: host
+          - target: darwin-x64
+            runner: macos-15-intel
+            uname: x86_64
+            package: "@kilocode/cli-darwin-x64"
+            mode: host
+          - target: linux-arm64
+            runner: ubuntu-24.04-arm
+            uname: aarch64
+            package: "@kilocode/cli-linux-arm64"
+            mode: host
+          - target: linux-x64
+            runner: ubuntu-24.04
+            uname: x86_64
+            package: "@kilocode/cli-linux-x64"
+            mode: host
+          - target: alpine-arm64
+            runner: ubuntu-24.04-arm
+            uname: aarch64
+            package: "@kilocode/cli-linux-arm64-musl"
+            mode: alpine
+            platform: linux/arm64
+          - target: alpine-x64
+            runner: ubuntu-24.04
+            uname: x86_64
+            package: "@kilocode/cli-linux-x64-musl"
+            mode: alpine
+            platform: linux/amd64
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: kilo-cli.tar.zst
+          path: /tmp
+          skip-decompress: true
+
+      - name: Unpack CLI dist
+        run: |
+          mkdir -p dist
+          tar --zstd -xf /tmp/kilo-cli.tar.zst -C dist
+
+      - name: Run CLI smoke test
+        run: |
+          test "$(uname -m)" = "${{ matrix.uname }}"
+
+          smoke_host() {
+            binary="$1"
+            "$binary" --version
+            root="$(mktemp -d)"
+            trap 'rm -rf "$root"' RETURN
+            (
+              unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR
+              export XDG_DATA_HOME="$root/data"
+              export XDG_CACHE_HOME="$root/cache"
+              export XDG_CONFIG_HOME="$root/config"
+              export XDG_STATE_HOME="$root/state"
+              export KILO_DISABLE_MODELS_FETCH=1
+              export KILO_DISABLE_PROJECT_CONFIG=1
+              export KILO_CONFIG_CONTENT='{"enabled_providers":["anthropic"]}'
+              export ANTHROPIC_API_KEY=dummy
+              "$binary" --pure models anthropic | grep -q '^anthropic/'
+            )
+          }
+
+          if [ "${{ matrix.mode }}" = "host" ]; then
+            smoke_host "./dist/${{ matrix.package }}/bin/kilo"
+            exit 0
+          fi
+
+          docker run --rm \
+            --platform "${{ matrix.platform }}" \
+            -v "$PWD/dist:/dist:ro" \
+            -e PACKAGE="${{ matrix.package }}" \
+            alpine:3.22 \
+            sh -c '
+              set -eu
+              # kilocode_change start - Bun musl binaries link against libstdc++ and libgcc_s
+              # (GCC C++ runtime). Alpine does not ship these by default; they are available
+              # as optional packages and must be installed for any Bun-compiled musl binary to run.
+              apk add --no-cache libstdc++ libgcc
+              # kilocode_change end
+              binary="/dist/$PACKAGE/bin/kilo"
+              "$binary" --version
+              root="$(mktemp -d)"
+              trap '\''rm -rf "$root"'\'' EXIT
+              unset KILO_MODELS_PATH KILO_MODELS_URL KILO_CONFIG KILO_CONFIG_DIR
+              export XDG_DATA_HOME="$root/data"
+              export XDG_CACHE_HOME="$root/cache"
+              export XDG_CONFIG_HOME="$root/config"
+              export XDG_STATE_HOME="$root/state"
+              export KILO_DISABLE_MODELS_FETCH=1
+              export KILO_DISABLE_PROJECT_CONFIG=1
+              export KILO_CONFIG_CONTENT='\''{"enabled_providers":["anthropic"]}'\''
+              export ANTHROPIC_API_KEY=dummy
+              "$binary" --pure models anthropic | grep -q "^anthropic/"
+            '
+
+  validate-cli-windows:
+    name: Validate CLI (windows-${{ matrix.arch }})
+    needs: build-cli
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            runner: windows-11-arm
+            package: "@kilocode/cli-windows-arm64"
+          - arch: x64
+            runner: windows-2025
+            package: "@kilocode/cli-windows-x64"
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: kilo-cli.tar.zst
+          path: ${{ runner.temp }}
+          skip-decompress: true
+
+      - name: Install zstd
+        shell: pwsh
+        run: |
+          if (-not (Get-Command zstd -ErrorAction SilentlyContinue)) {
+            choco install zstandard -y --no-progress
+          }
+
+      - name: Unpack CLI dist
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path dist | Out-Null
+          zstd -d --stdout "$env:RUNNER_TEMP\kilo-cli.tar.zst" | tar -xf - -C dist
+
+      - name: Run CLI smoke test
+        shell: pwsh
+        run: |
+          $package = "${{ matrix.package }}".Replace("/", "\")
+          $binary = ".\dist\$package\bin\kilo.exe"
+          & $binary --version
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          $root = Join-Path $env:RUNNER_TEMP ([guid]::NewGuid().ToString())
+          New-Item -ItemType Directory -Force -Path $root | Out-Null
+          try {
+            foreach ($name in "KILO_MODELS_PATH", "KILO_MODELS_URL", "KILO_CONFIG", "KILO_CONFIG_DIR") {
+              Remove-Item "Env:$name" -ErrorAction SilentlyContinue
+            }
+            $env:XDG_DATA_HOME = Join-Path $root "data"
+            $env:XDG_CACHE_HOME = Join-Path $root "cache"
+            $env:XDG_CONFIG_HOME = Join-Path $root "config"
+            $env:XDG_STATE_HOME = Join-Path $root "state"
+            $env:KILO_DISABLE_MODELS_FETCH = "1"
+            $env:KILO_DISABLE_PROJECT_CONFIG = "1"
+            $env:KILO_CONFIG_CONTENT = '{"enabled_providers":["anthropic"]}'
+            $env:ANTHROPIC_API_KEY = "dummy"
+            $output = & $binary --pure models anthropic
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+            if (-not ($output -match "(?m)^anthropic/")) {
+              throw "Compiled Windows binary did not list Anthropic models from the embedded snapshot"
+            }
+          } finally {
+            Remove-Item -Recurse -Force $root -ErrorAction SilentlyContinue
+          }
+  # kilocode_change end
+  build-vscode:
+    needs:
+      - build-cli
+      - validate-cli-unix
+      - validate-cli-windows
    runs-on: blacksmith-4vcpu-ubuntu-2404
    if: github.repository == 'Kilo-Org/kilocode'
    steps:
@@ -181,6 +360,8 @@ jobs:
      - version
      - build-cli
      - build-vscode
+      - validate-cli-unix # kilocode_change
+      - validate-cli-windows # kilocode_change
      - smoke-test
    runs-on: ubuntu-24.04
    steps:
@@ -125,7 +125,7 @@ jobs:
          ./scripts/run_eval.sh \
            -m kilo/anthropic/claude-sonnet-4.6 \
            -d terminal-bench-sample \
-            -t "log-summary-date-ranges" \
+            --include-task-name "log-summary-date-ranges" \
            --job-name smoke-test-log-summary \
            --timeout-multiplier 2

@@ -0,0 +1,103 @@
+# kilocode_change - new file
+name: test-jetbrains
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  changes:
+    name: detect JetBrains changes
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    outputs:
+      jetbrains: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.filter.outputs.jetbrains }}
+    steps:
+      - name: Checkout repository
+        if: github.event_name != 'workflow_dispatch'
+        uses: actions/checkout@v6
+
+      - name: Detect JetBrains changes
+        if: github.event_name != 'workflow_dispatch'
+        id: filter
+        uses: Kilo-Org/paths-filter@668c092af3649c4b664c54e4b704aa46782f6f7c # v3
+        with:
+          predicate-quantifier: every
+          filters: |
+            jetbrains:
+              - '**'
+              - '!packages/kilo-vscode/**'
+              - '!packages/kilo-docs/**'
+
+  unit:
+    name: jetbrains
+    needs: changes
+    if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.jetbrains == 'true'
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    container:
+      image: ghcr.io/kilo-org/build/jetbrains:24.04
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Mark workspace as git-safe
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run JetBrains unit tests
+        run: bun script/test-ci.ts
+        working-directory: packages/kilo-jetbrains
+
+      - name: Publish JetBrains unit reports
+        if: always()
+        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
+        with:
+          report_paths: packages/kilo-jetbrains/.artifacts/unit/junit.xml
+          check_name: "unit results (jetbrains)"
+          detailed_summary: true
+          include_time_in_summary: true
+          fail_on_failure: false
+
+      - name: Upload JetBrains unit artifacts
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: unit-jetbrains-${{ github.run_attempt }}
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 7
+          path: packages/kilo-jetbrains/.artifacts/unit/junit.xml
+
+  required:
+    name: result
+    needs:
+      - changes
+      - unit
+    if: always()
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Verify JetBrains jobs passed
+        run: |
+          echo "changes=${{ needs.changes.result }}"
+          echo "jetbrains=${{ needs.unit.result }}"
+          test "${{ needs.changes.result }}" = "success"
+          if [ "${{ needs.changes.outputs.jetbrains }}" = "true" ]; then
+            test "${{ needs.unit.result }}" = "success"
+          else
+            test "${{ needs.changes.outputs.jetbrains }}" = "false"
+            test "${{ needs.unit.result }}" = "skipped"
+          fi
@@ -21,6 +21,7 @@ env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

 jobs:
+  # kilocode_change start
  unit:
    name: unit (${{ matrix.settings.name }})
    strategy:
@@ -32,6 +33,7 @@ jobs:
          - name: windows
            host: blacksmith-4vcpu-windows-2025 # kilocode_change
    runs-on: ${{ matrix.settings.host }}
+    timeout-minutes: 45 # kilocode_change
    defaults:
      run:
        shell: bash
@@ -45,7 +47,7 @@ jobs:
      - name: Setup Node
        id: setup-node
        continue-on-error: ${{ runner.os == 'Windows' }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6 # kilocode_change
        with:
          node-version: "24"

@@ -59,14 +61,6 @@ jobs:
      - name: Setup Bun
        uses: ./.github/actions/setup-bun

-      # kilocode_change start
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "21"
-      # kilocode_change end
-
      - name: Configure git identity
        run: |
          git config --global user.email "kilo-maintainer[bot]@users.noreply.github.com"
@@ -82,13 +76,18 @@ jobs:
            turbo-${{ runner.os }}-

      - name: Run unit tests
-        run: bun turbo test:ci
+        run: bun turbo test:ci --filter='!@kilocode/kilo-jetbrains'
        env:
          KILO_EXPERIMENTAL_DISABLE_FILEWATCHER: ${{ runner.os == 'Windows' && 'true' || 'false' }}

+      - name: Run HttpApi exerciser gates
+        if: runner.os == 'Linux'
+        working-directory: packages/opencode
+        run: bun run test:httpapi
+
      - name: Publish unit reports
        if: always()
-        uses: mikepenz/action-junit-report@v6
+        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
        with:
          report_paths: packages/*/.artifacts/unit/junit.xml
          check_name: "unit results (${{ matrix.settings.name }})"
@@ -105,15 +104,31 @@ jobs:
          if-no-files-found: ignore
          retention-days: 7
          path: packages/*/.artifacts/unit/junit.xml
+  # kilocode_change end

+  # kilocode_change start
+  jetbrains:
+    name: jetbrains
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: read
+    uses: ./.github/workflows/test-jetbrains.yml
+  # kilocode_change end
+
+  # kilocode_change start
  required:
    name: test (linux)
    runs-on: blacksmith-4vcpu-ubuntu-2404
    needs:
      - unit
+      - jetbrains
    if: always()
    steps:
      - name: Verify upstream test jobs passed
        run: |
          echo "unit=${{ needs.unit.result }}"
+          echo "jetbrains=${{ needs.jetbrains.result }}"
          test "${{ needs.unit.result }}" = "success"
+          test "${{ needs.jetbrains.result }}" = "success"
+  # kilocode_change end
@@ -8,7 +8,8 @@ on:
  workflow_dispatch:

 jobs:
-  typecheck:
+  typecheck-js:
+    name: typecheck-js
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
@@ -18,12 +19,51 @@ jobs:
        uses: ./.github/actions/setup-bun

      # kilocode_change start
+      - name: Run TypeScript typecheck
+        run: bun turbo typecheck --filter='!@kilocode/kilo-jetbrains'
+
+      - name: Build Kilo Console
+        run: bun turbo build --filter=@kilocode/kilo-console
+      # kilocode_change end
+
+  # kilocode_change start
+  typecheck-jetbrains:
+    name: typecheck-jetbrains
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
-      # kilocode_change end

-      - name: Run typecheck
-        run: bun typecheck
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+
+      - name: Run JetBrains typecheck
+        run: ./gradlew typecheck
+        working-directory: packages/kilo-jetbrains
+
+  required:
+    name: typecheck
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs:
+      - typecheck-js
+      - typecheck-jetbrains
+    if: always()
+    steps:
+      - name: Verify typecheck jobs passed
+        run: |
+          echo "typecheck-js=${{ needs.typecheck-js.result }}"
+          echo "typecheck-jetbrains=${{ needs.typecheck-jetbrains.result }}"
+          test "${{ needs.typecheck-js.result }}" = "success"
+          test "${{ needs.typecheck-jetbrains.result }}" = "success"
+  # kilocode_change end
@@ -13,21 +13,25 @@ jobs:
      is_fork: ${{ steps.fork-check.outputs.is_fork }}
    steps:
      - uses: actions/checkout@v6 # kilocode_change
-      - uses: Kilo-Org/paths-filter@master
+      # kilocode_change start
+      - name: Check changed files
        id: filter
-        with:
-          filters: |
-            matched:
-              - "packages/kilo-ui/**"
-              - "packages/ui/**"
-              - "packages/util/**"
-              - "packages/sdk/js/**"
-              - "packages/kilo-vscode/webview-ui/**"
-              - "packages/kilo-vscode/.storybook/**"
-              - "packages/kilo-vscode/tests/visual-regression*"
-              - "packages/kilo-vscode/tests/permission-dock-dropdown*"
-              - "packages/kilo-docs/public/img/screenshot-tests/**"
-              - ".github/workflows/visual-regression.yml"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          matched=false
+          while IFS= read -r file; do
+            case "$file" in
+              packages/kilo-ui/*|packages/ui/*|packages/util/*|packages/sdk/js/*|packages/kilo-vscode/webview-ui/*|packages/kilo-vscode/.storybook/*|packages/kilo-vscode/tests/visual-regression*|packages/kilo-vscode/tests/permission-dock-dropdown*|packages/kilo-vscode/tests/accessibility*|packages/kilo-docs/public/img/screenshot-tests/*|.github/workflows/visual-regression.yml)
+                matched=true
+                break
+                ;;
+            esac
+          done < <(gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls/${PR}/files" --jq '.[].filename')
+          echo "matched=$matched" >> "$GITHUB_OUTPUT"
+          echo "matched=$matched"
+      # kilocode_change end
      - name: Check if PR is from a fork
        id: fork-check
        run: |
@@ -207,6 +211,10 @@ jobs:
    name: Visual Regression (kilo-vscode webview)
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
+    # kilocode_change start
+    env:
+      NODE_OPTIONS: --max-old-space-size=4096
+    # kilocode_change end

    steps:
      - name: Checkout (internal)
@@ -276,13 +284,18 @@ jobs:
        if: steps.storybook-cache-vscode.outputs.cache-hit != 'true'
        run: bun run build-storybook
        working-directory: packages/kilo-vscode
+        # kilocode_change start
+        env:
+          NODE_OPTIONS: --max-old-space-size=4096
+        # kilocode_change end

-      - name: Generate baselines for new/missing stories
+      - name: Generate baselines and enforce webview accessibility checks # kilocode_change
        run: bun run test:visual:update
        working-directory: packages/kilo-vscode
        env:
          CI: true
          PLAYWRIGHT_WORKERS: "4"
+          NODE_OPTIONS: --max-old-space-size=4096 # kilocode_change

      - name: Remove stale baselines for deleted stories
        run: |
@@ -12,7 +12,7 @@ permissions:

 jobs:
  check-release:
-    if: vars.OPENCODE_WATCH_ENABLED != 'false'
+    if: github.repository == 'Kilo-Org/kilocode' && vars.OPENCODE_WATCH_ENABLED != 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
@@ -40,9 +40,12 @@ jobs:
        env:
          URL: ${{ secrets.OPENCODE_WATCH_SYNC_URL }}
          SECRET: ${{ secrets.OPENCODE_WATCH_SYNC_SECRET }}
+          VERCEL: ${{ secrets.OPENCODE_WATCH_VERCEL_SECRET }}
        run: |
          if [ -n "$URL" ] && [ -n "$SECRET" ]; then
-            curl -sf -X POST "$URL" -H "x-sync-secret: $SECRET" -H "Content-Type: application/json" -d '{}' || true
+            headers=(-H "x-sync-secret: $SECRET" -H "Content-Type: application/json")
+            [ -n "$VERCEL" ] && headers+=(-H "x-vercel-protection-bypass: $VERCEL")
+            curl -sf -X POST "$URL" "${headers[@]}" -d '{}' || true
          fi

      - if: steps.fetch.outputs.tag != '' && steps.cache.outputs.cache-hit != 'true'
@@ -5,6 +5,7 @@ node_modules
 .worktrees
 .sst
 .env
+.env.local
 .idea/*
 !.idea/gradle.xml
 !.idea/.run
@@ -34,6 +35,7 @@ a.out
 target
 .scripts
 .direnv/
+packages/kilo-jetbrains/build-tasks/.gradle/

 # Local dev files
 opencode-dev
@@ -0,0 +1,5 @@
+# Fake secret-looking strings used by HTTP recorder redaction tests.
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:generic-api-key:69
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:generic-api-key:92
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:generic-api-key:146
+afa57acfda894e0ebf3c637dd710310b705c0a2f:packages/http-recorder/test/record-replay.test.ts:gcp-api-key:71
@@ -0,0 +1,69 @@
+---
+description: Review an upstream merge PR and write reports
+---
+
+Review $1.
+
+Branch off so we have all the code for the reviewed PR. Then run the following reviews in parallel, using one subagent per review, and save each result in the named markdown file at the repository root. A human will read those files, so if in doubt add a finding for human verification.
+
+When all subagents are done, commit the report files and create a draft PR with the reviewed PR branch as base.
+
+Do not include exhaustive per-file checklists in the report files. Summarize the scope and methodology, then list only findings, notable non-findings, command outputs, and limitations.
+
+## KILOCODE_CHANGE_MARKERS.md
+
+Review carefully, file by file, whether we accidentally removed any `kilocode_change` marker.
+
+Get the full list of files changed in the reviewed PR. Check each changed file. For each file, compare both our `main` branch and the upstream-merged version in the reviewed PR. Determine whether any marker removal, marker move, or Kilo-specific change makes sense, and comment on that.
+
+Do not include a full "Files Checked" section. Mention the number of changed files checked, but only list files that have findings or need human verification.
+
+## INFRASTRUCTURE_CHANGE.md
+
+Review whether this PR adds, removes, or changes any infrastructure, such as GitHub Actions, CI config, release/deploy scripts, Docker/build infrastructure, package manager/workspace infrastructure, repository automation, issue templates, changelog automation, or generated SDK/build automation.
+
+We want to merge upstream code but keep our own infrastructure, so flag anything infrastructure-related. When in doubt, add a finding and say a human should check manually.
+
+Do not include a full "Files Checked" section. Only list infrastructure-relevant files and findings.
+
+## OPENCODE_MENTIONS.md
+
+Check whether the merge now mentions OpenCode somewhere user-facing instead of Kilo, or links to OpenCode web properties.
+
+Focus on UI strings, docs, help text, package metadata shown to users, URLs, CLI output, config docs, generated SDK/OpenAPI descriptions, and error messages.
+
+## UNNECESSARY_MARKERS.md
+
+Check whether any merged files now use `kilocode_change` markers without any actual difference to upstream.
+
+Use `script/upstream/find-reset-candidates.ts --dry-run` to see whether any files changed in the PR are actually now identical to upstream. If you find candidates, verify them with `script/upstream/reset-to-upstream.ts --dry-run`.
+
+## BROKEN_PIPELINE_CHAINS.md
+
+Review this PR for broken end-to-end chains where our custom functionality requires changes across multiple files or layers, but the merge may have removed or altered an intermediate step. The code may still compile, so these issues can be silent.
+
+Look for cases like:
+
+- A parameter that is set but never read.
+- A field that is populated but never passed through.
+- An event that is emitted but no longer handled.
+- A config option that is defined but never propagated to where it is used.
+- A type definition extended on one side but not consumed on the other.
+
+For each `kilocode_change` in this PR, trace the full chain: where the value or behavior is introduced, where it needs to flow through, and where it is ultimately consumed. Verify every link in the chain still exists after the merge.
+
+Pay special attention to:
+
+- Props or parameters passed through multiple component or function layers.
+- Values written to state, context, or storage that are read elsewhere.
+- Message types, events, or IPC handlers where sender and receiver must match.
+- Configuration or feature flags defined in one place and checked in another.
+- Type definitions extended on one side but consumed on the other.
+
+When in doubt, add a finding. A human will verify it. Compiling code is not proof the chain is intact.
+
+## TESTS.md
+
+Check whether this PR removed any Kilo-specific tests.
+
+Kilo-specific tests may live in paths containing `kilo` or `kilocode`, or may include Kilo-specific assertions, fixtures, or `kilocode_change` markers.
@@ -0,0 +1,37 @@
+# Sample Plan With Todos
+
+## Goal
+Create a clear sample plan that breaks work into actionable todos.
+
+## Todos
+
+1. Define the objective
+   - Clarify the desired outcome.
+   - Identify the target audience.
+   - List success criteria.
+
+2. Gather requirements
+   - Collect relevant inputs.
+   - Note constraints and assumptions.
+   - Identify dependencies.
+
+3. Break down the work
+   - Split the goal into smaller tasks.
+   - Prioritize tasks by importance.
+   - Estimate effort for each task.
+
+4. Execute the tasks
+   - Complete the highest-priority items first.
+   - Track progress as todos are finished.
+   - Adjust the plan if new information appears.
+
+5. Review and validate
+   - Check that all todos are complete.
+   - Verify the result matches the goal.
+   - Document any follow-up work.
+
+## Acceptance Criteria
+- The plan has a clear goal.
+- The plan includes a list of actionable todos.
+- The todos are ordered logically.
+- The plan includes a way to confirm completion.
@@ -0,0 +1,38 @@
+# Sample Plan With Todos
+
+## Goal
+Create a simple sample plan that demonstrates how to organize work into clear, actionable todos.
+
+## Implementation Steps
+
+1. Define the objective
+   - State the desired outcome in one sentence.
+   - Identify who the plan is for.
+   - List the criteria that indicate success.
+
+2. Gather requirements
+   - Capture relevant inputs and context.
+   - Note constraints, assumptions, and dependencies.
+   - Identify any missing information that may affect execution.
+
+3. Break down the work
+   - Split the objective into smaller tasks.
+   - Order tasks by dependency and priority.
+   - Keep each todo specific enough to complete independently.
+
+4. Execute the todos
+   - Work through the highest-priority tasks first.
+   - Mark todos complete as progress is made.
+   - Update the plan if new information changes the scope.
+
+5. Review the result
+   - Confirm every todo has been addressed.
+   - Verify the result matches the original objective.
+   - Record any follow-up work separately.
+
+## Acceptance Criteria
+
+- The plan has a clear goal.
+- The plan includes actionable todos.
+- The todos are ordered logically.
+- The plan includes a review step to confirm completion.
@@ -0,0 +1,37 @@
+# Sample Plan: Add Todo-Based Workflow
+
+## Goal
+Create a small, traceable workflow for implementing a feature with clear todos, validation steps, and completion criteria.
+
+## Scope
+- Identify the affected package or feature area.
+- Make the smallest correct code change.
+- Add or update tests only where they verify behavior.
+- Run the smallest relevant checks before completion.
+
+## Todos
+- [ ] Inspect the relevant files and existing patterns.
+- [ ] Confirm whether the change belongs in Kilo-owned code or shared upstream code.
+- [ ] Implement the minimal code change.
+- [ ] Add or update targeted tests if behavior changes.
+- [ ] Run formatting or linting if the touched package requires it.
+- [ ] Run the smallest relevant typecheck or test command.
+- [ ] Fix any failures introduced by the change.
+- [ ] Summarize changed files and verification results.
+
+## Implementation Notes
+- Prefer Kilo-owned directories for Kilo-specific behavior.
+- If shared upstream files must be edited, keep the change narrow and add `kilocode_change` markers where required.
+- Avoid broad refactors unless they are necessary for the requested behavior.
+- Preserve existing style, naming, and package conventions.
+
+## Verification
+- Run the targeted test for the changed behavior when available.
+- Run the package typecheck if TypeScript code changes.
+- Run any repo-specific guard required by touched files, such as annotation or source-link checks.
+
+## Completion Criteria
+- The requested behavior is implemented.
+- Tests or checks relevant to the change pass, or any inability to run them is documented.
+- No unrelated files are modified.
+- The final response includes a concise summary and verification status.
@@ -0,0 +1,35 @@
+# Sample Plan
+
+## Goal
+Create a small example feature or change using a clear implementation workflow and tracked todo list.
+
+## Scope
+- Add or update a minimal code path.
+- Add focused tests for the changed behavior.
+- Run the smallest relevant verification command.
+- Summarize the result and any follow-up work.
+
+## Todo
+- [ ] Inspect the relevant files and existing patterns.
+- [ ] Identify the smallest safe implementation approach.
+- [ ] Make the code change.
+- [ ] Add or update tests for the behavior.
+- [ ] Run targeted tests or typecheck.
+- [ ] Fix any failures introduced by the change.
+- [ ] Provide a concise final summary with verification results.
+
+## Implementation Notes
+- Prefer the smallest correct change over broad refactors.
+- Preserve existing style and naming conventions.
+- Avoid touching unrelated files.
+- If shared upstream-owned files are involved, use the repository’s `kilocode_change` marker guidance.
+
+## Verification
+Run the most specific applicable check for the touched area, such as:
+- CLI: `bun test ./path/to/test.ts` from `packages/opencode/`
+- VS Code extension: `bun run test:unit` from `packages/kilo-vscode/`
+- Cross-package changes: `bun run typecheck` from the repo root
+
+## Risks
+- The sample scope may need adjustment once the real target files are known.
+- Verification commands depend on which package is touched.
@@ -0,0 +1,69 @@
+# Plan: Replace Internal SVGLoader Usage
+
+## Context
+
+The JetBrains plugin currently imports `com.intellij.util.SVGLoader` in `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt` and calls `SVGLoader.load(ByteArrayInputStream(patch()), scale.toFloat())` from `SvgIcon.image(Graphics)`.
+
+Inspection reports this as an internal API usage because `SVGLoader` and its `load(InputStream, float)` method are marked `@ApiStatus.Internal`.
+
+I checked the local IntelliJ source reference via `$INTELLIJ_REPO=/Users/kirillk/products/intellij-community`:
+
+- `platform/util/ui/src/com/intellij/util/SVGLoader.kt`
+- `platform/util/ui/src/com/intellij/ui/svg/svg.kt`
+- `platform/util/ui/src/com/intellij/ui/svg/jsvg.kt`
+- `libraries/jsvg/intellij.libraries.jsvg.iml`
+
+Important findings:
+
+- IntelliJ `SVGLoader.load(stream, scale)` delegates to internal `loadSvg(...)` in `com.intellij.ui.svg`.
+- The actual renderer uses `com.github.weisj:jsvg:2.1.0` and renders into a `BufferedImage` with antialiasing, bicubic interpolation, and pure stroke control.
+- Copying `SVGLoader.kt` directly would keep references to other internal IntelliJ APIs (`IconLoader`, `ScaleContext`, `ImageUtil`, `SvgAttributePatcher`, `createJSvgDocument`, `renderSvgWithSize`, cache classes, etc.) and would be broader than needed.
+
+## Implementation Plan
+
+1. Add Kilo-owned SVG rendering code under the frontend UI package, for example:
+   - `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/ui/SvgLoader.kt`
+   - Package: `ai.kilocode.client.ui`
+   - Suggested internal object name: `SvgLoader`
+
+2. Keep the copied implementation minimal and purpose-specific:
+   - Accept `InputStream` and `scale: Float`.
+   - Parse the SVG with `com.github.weisj.jsvg.parser.SVGLoader().load(stream)` or the equivalent public jsvg API available in version `2.1.0`.
+   - Determine image dimensions from the root SVG `width` and `height` already parsed by existing `SvgIconColorizer.size(...)`, or by passing dimensions into the loader if the public jsvg API does not expose reliable intrinsic size.
+   - Render into `BufferedImage(width * scale, height * scale, BufferedImage.TYPE_INT_ARGB)` using `Graphics2D` rendering hints matching IntelliJ’s `jsvg.kt`:
+     - `KEY_ANTIALIASING = VALUE_ANTIALIAS_ON`
+     - `KEY_INTERPOLATION = VALUE_INTERPOLATION_BICUBIC`
+     - `KEY_STROKE_CONTROL = VALUE_STROKE_PURE`
+   - Return `Image`/`BufferedImage`.
+
+3. If jsvg does not expose intrinsic size cleanly from public API, adjust the API to avoid duplicating SVG parsing:
+   - Add `width` and `height` parameters to the Kilo loader.
+   - In `SvgIcon.image(Graphics)`, call the loader with the already-computed `size.first` and `size.second`.
+   - This is the likely smallest stable solution because current icons already require explicit `width` and `height` for `SvgIconColorizer.size(...)`.
+
+4. Add the jsvg dependency explicitly to the plugin frontend module instead of relying on the IntelliJ-bundled library:
+   - In `packages/kilo-jetbrains/gradle/libs.versions.toml`, add `jsvg = "2.1.0"` and `jsvg = { module = "com.github.weisj:jsvg", version.ref = "jsvg" }`.
+   - In `packages/kilo-jetbrains/frontend/build.gradle.kts`, add `implementation(libs.jsvg)`.
+   - This follows the package instruction to bundle third-party libraries with the plugin rather than relying on IDE-bundled versions.
+
+5. Update `SvgIconColorizer.kt`:
+   - Remove `import com.intellij.util.SVGLoader`.
+   - Replace `SVGLoader.load(ByteArrayInputStream(patch()), scale.toFloat())` with the Kilo-owned loader call.
+   - Keep the existing color patching, cache key, scale calculation, and size parsing intact.
+
+6. Add a focused frontend unit test:
+   - New test file: `frontend/src/test/kotlin/ai/kilocode/client/ui/SvgIconColorizerTest.kt` or `SvgLoaderTest.kt`.
+   - Exercise the actual loader/colorizer with a small SVG resource or inline SVG bytes.
+   - Assert that rendering returns a non-empty image at scale `1f` and `2f`, and that scaled dimensions are correct.
+   - If testing the colorizer, paint the icon into a `BufferedImage` and verify at least one expected patched pixel color appears.
+
+7. Run verification from `packages/kilo-jetbrains/`:
+   - `./gradlew typecheck`
+   - A targeted frontend test if Gradle supports one cleanly, otherwise `./gradlew test`.
+   - The requested DevKit internal API inspection is IDE-based; note in final response that the code no longer references `com.intellij.util.SVGLoader`, and typecheck/tests were run.
+
+## Notes And Risks
+
+- The user said “copy SaveLoaer”; I interpret this as “copy `SVGLoader`”. The implementation should copy the relevant rendering behavior, not IntelliJ’s full internal `SVGLoader` object, because the full source depends on multiple other internal APIs and cache infrastructure.
+- This change is in `packages/kilo-jetbrains/`, a Kilo-owned package, so `kilocode_change` markers are not needed.
+- jsvg package names and constructors should be confirmed during implementation against the downloaded dependency/API available to Gradle. If the API differs from IntelliJ source usage, inspect the source jar or compile error and adapt the minimal wrapper accordingly.
@@ -0,0 +1,60 @@
+# Remove JetBrains SVG Runtime Colorization
+
+## Goal
+Stop runtime SVG recoloring in the JetBrains plugin and rely on IntelliJ's standard light/dark icon asset resolution. Ensure every SVG asset used by the plugin has a light/dark pair.
+
+## Findings
+- Runtime colorization exists only in `frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt`.
+- The only production caller is `frontend/src/main/kotlin/ai/kilocode/client/session/scroll/ScrollButtonIcon.kt`.
+- `ScrollButtonIcon` colorizes two icons at runtime:
+  - `/icons/scroll-bottom.svg`
+  - `/icons/scroll-question.svg`
+- Both already have dark variants:
+  - `scroll-bottom_dark.svg`
+  - `scroll-question_dark.svg`
+- Other used frontend icons already have light/dark pairs:
+  - `send.svg` / `send_dark.svg`
+  - `stop.svg` / `stop_dark.svg`
+  - `shield.svg` / `shield_dark.svg`
+  - `shield-filled.svg` / `shield-filled_dark.svg`
+  - `compress.svg` / `compress_dark.svg`
+  - `chevron-down.svg` / `chevron-down_dark.svg`
+  - `arrow-up.svg` / `arrow-up_dark.svg`
+  - `arrow-down-to-line.svg` / `arrow-down-to-line_dark.svg`
+  - `kilo.svg` / `kilo_dark.svg`
+  - `kilo-content.svg` / `kilo-content_dark.svg`
+  - `plus.svg` / `plus_dark.svg` exists, though no current direct source reference was found.
+  - `kilo@20x20.svg` / `kilo@20x20_dark.svg` exists, though no current direct source reference was found.
+- `src/main/resources/META-INF/pluginIcon.svg` is present and has no `pluginIcon_dark.svg`. It is not referenced in source/XML, but JetBrains treats this filename conventionally as plugin metadata/marketplace icon, so it should be paired for completeness.
+- The SVG assets use literal colors and no `currentColor`, `<style>`, CSS classes, or CSS variables were found in `frontend/src/main/resources/icons/*.svg`.
+
+## Implementation Plan
+1. Replace `ScrollButtonIcon` runtime colorization with standard `IconLoader.getIcon(...)` loading.
+   - Remove imports for `colorizedSvgIcon`, `SessionUiStyle`, `UiStyle`, `JBUI`, and `Color` from `ScrollButtonIcon.kt`.
+   - Add `IconLoader` import.
+   - Load `bottom` with `IconLoader.getIcon("/icons/scroll-bottom.svg", ScrollButtonIcon::class.java)`.
+   - Load `prompt` with `IconLoader.getIcon("/icons/scroll-question.svg", ScrollButtonIcon::class.java)`.
+   - Keep `create(question: Boolean = false)` unchanged so callers continue to receive the appropriate icon.
+   - IntelliJ should automatically resolve `_dark.svg` variants when the look and feel is dark.
+2. Delete `frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt` after confirming no callers remain.
+3. Remove now-unused scroll icon source palette constants from `SessionUiStyle.ScrollIcon`.
+   - Delete the `ScrollIcon` object if no references remain.
+   - This also removes stale comments about runtime colorization.
+4. Add `src/main/resources/META-INF/pluginIcon_dark.svg` as the dark-mode pair for `pluginIcon.svg`.
+   - Use the same artwork/colors as `pluginIcon.svg` unless there is a desired brand-specific dark variant; the current icon already has a black background and yellow mark, so an identical dark pair is acceptable and satisfies IntelliJ's expected pair convention.
+5. Re-scan the JetBrains package after edits.
+   - Confirm there are no `colorizedSvgIcon` or `SvgIconColorizer` references.
+   - Confirm every used SVG path has a sibling `_dark.svg` where IntelliJ expects one.
+   - Confirm no frontend SVG uses `currentColor`, `<style>`, CSS classes, or CSS variables.
+6. Run the smallest relevant verification from `packages/kilo-jetbrains/`:
+   - `bun run typecheck` or `./gradlew typecheck`.
+
+## Files Expected To Change
+- `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/scroll/ScrollButtonIcon.kt`
+- `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/style/SessionUiStyle.kt`
+- Delete `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/ui/SvgIconColorizer.kt`
+- Add `packages/kilo-jetbrains/src/main/resources/META-INF/pluginIcon_dark.svg`
+
+## Risks
+- The scroll icons will no longer follow arbitrary runtime theme colors; they will use the static light/dark SVG asset colors. This matches the requested behavior.
+- If a non-default theme expects palette overrides, static literal SVG colors still follow normal IntelliJ SVG handling better than custom byte-patching, but the exact custom-color behavior may differ from the old colorizer.
@@ -0,0 +1,49 @@
+# Fix JetBrains Session Question Scroll
+
+## Goal
+When a question-like active view first appears in the JetBrains session UI, do not auto-scroll the transcript if the user is already away from the tail and the scroll-to-bottom button is visible. This applies to permission prompts and question-based views. Existing behavior should remain: if the transcript is already at the bottom, new questions/permissions keep the view at the bottom; explicit question navigation can still jump to the active card.
+
+## Current Findings
+- `SessionUi` wires `QuestionView` with:
+  - `follow = { scroll.following() }`
+  - `scroll = { scroll.followBottom(it) }`
+- `QuestionView.show()` runs on first display and calls:
+  - `val tail = follow()` before rendering the card
+  - `scroll(tail)` after rendering
+- `SessionScroll.following()` currently returns `component.viewport.view === messages && tail`.
+- This can use stale internal follow state instead of the live scrollbar state. The user-visible condition is better represented by `SessionScroll.atBottom()`, which is also what `SessionController.beforeUpdate` uses for normal transcript updates.
+- Existing `SessionScrollTest` already covers question and login-required middle-scroll preservation, but it does not cover permission first appearance and likely does not cover a stale-tail/live-not-at-bottom edge.
+
+## Implementation Plan
+1. Update question first-show follow sampling to use live bottom state.
+   - In `SessionUi.buildUi()`, change the `QuestionView` `follow` lambda from `scroll.following()` to `scroll.atBottom()`.
+   - Alternatively, if a single semantic API is preferred, change `SessionScroll.following()` to return `component.viewport.view === messages && atBottom()` and keep the `SessionUi` call site unchanged. Prefer the smaller, clearer call-site change unless tests show other `following()` behavior should change too.
+
+2. Add permission scroll regression tests in `SessionScrollTest`.
+   - Add `test permission appearing at bottom keeps scroll at bottom`.
+   - Add `test permission appearing while user is in middle preserves scroll position`.
+   - Emit `ChatEventDto.PermissionAsked("ses_test", PermissionRequestDto(...))` using the same DTO style as the existing recovered permission test.
+   - Assert the scrollbar value is preserved and `jumpButton().isVisible` stays true when initially away from bottom.
+
+3. Strengthen question regression coverage if needed.
+   - Keep the existing `test question appearing while user is in middle preserves scroll position`.
+   - If the bug reproduces only when the jump button is visible but `tail` can be stale, add a targeted regression that creates the visible jump state before `QuestionAsked` and asserts first display does not jump.
+   - Avoid adding production-only test hooks; use existing `setValue`, `setValuePassive`, `drainScroll`, and event helpers.
+
+4. Preserve intentional explicit navigation behavior.
+   - Do not change `QuestionView.goForward()`, `goBack()`, or `goReview()`, which intentionally call `scroll(true)` and are covered by existing tests that expect navigation to jump to the active question card.
+   - Do not change prompt growth or normal streaming follow behavior unless a failing test shows the same stale-state issue applies there.
+
+5. Verification.
+   - Run the targeted JetBrains frontend session scroll tests from `packages/kilo-jetbrains/` using Gradle test filtering for `SessionScrollTest` if supported.
+   - Run `./gradlew typecheck` from `packages/kilo-jetbrains/` if the targeted tests pass or if Gradle filtering is unavailable.
+   - If Java 21 is unavailable, first check/report that blocker as instructed by the repo docs.
+
+## Expected Files To Touch
+- `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/SessionUi.kt`
+- `packages/kilo-jetbrains/frontend/src/test/kotlin/ai/kilocode/client/session/SessionScrollTest.kt`
+
+## Non-Goals
+- No backend or RPC protocol changes.
+- No redesign of the session scroll algorithm.
+- No changes to explicit question navigation auto-scroll behavior.
@@ -0,0 +1,81 @@
+# Plan: JetBrains Question-Style Scroll Button
+
+## Goal
+
+Fix JetBrains session scrolling so that when any inline prompt card appears while the scroll/jump button is already visible, the transcript scroll position is preserved and only the scroll button state changes. This applies to all current `BaseQuestionView`-backed session cards: questions, permissions, and login-required prompts. Preserve existing behavior that question navigation, review/back/next, and bottom-following content changes auto-scroll when they are supposed to.
+
+## Findings
+
+- The relevant files are `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/SessionUi.kt`, `.../scroll/SessionScroll.kt`, `.../views/question/QuestionView.kt`, `.../views/permission/PermissionView.kt`, `.../views/LoginRequiredView.kt`, `.../views/base/BaseQuestionView.kt`, and `frontend/src/test/kotlin/ai/kilocode/client/session/SessionScrollTest.kt`.
+- `QuestionView`, `PermissionView`, and `LoginRequiredView` do not inherit from `BaseQuestionView`; they compose it as the shared card shell. Scroll behavior should stay outside `BaseQuestionView` because it is a pure visual component with no session scroll context.
+- The current uncommitted `SessionUi.kt` attempt changes `QuestionView` from `follow = { scroll.following() }` to `follow = { scroll.atBottom() }`.
+- That fixes initial question appearance when the user is visibly away from bottom, but it is too broad because `QuestionView.follow()` is also used after custom editor growth, selection refresh, reply/reject, and other internal updates.
+- `QuestionView` already intentionally calls `scroll(true)` in `goBack`, `goForward`, and `goReview`; those forced calls are the behavior that preserves auto-scroll when switching question pages.
+- `PermissionView.show()` and `LoginRequiredView.show()` do not call scroll directly. They rely on `SessionController.beforeUpdate` / `afterUpdate`, which samples `scroll.atBottom()` before the state change and calls `scroll.followBottom(follow)` afterward. With the stale-tail fix, this path can preserve scroll for all non-question inline prompt cards.
+- The uncommitted `SessionScroll.followBottom(false)` change that clears stale `tail` when the transcript is visible and not actually at bottom is directionally correct. It prevents later `following()` calls from resurrecting auto-follow after a non-follow decision.
+- The current scroll button pending state is named `question` / `setQuestionPending` and is only enabled for non-plan `AwaitingQuestion`. To cover all `BaseQuestionView`-backed prompts, this should become a generic pending-input/attention state and include `AwaitingPermission` and `LoginRequired`.
+- Existing behavior intentionally keeps plan follow-up questions using the normal scroll icon (`test plan followup question keeps scroll icon`), so preserve that exception unless product intent changes separately.
+- The uncommitted `build.gradle.kts` and `script/build-sign-check.sh` changes are unrelated to this bug and should not be touched as part of this fix.
+
+## Implementation Plan
+
+1. In `QuestionView.kt`, split the scroll-follow decision into two callbacks.
+
+- Keep the existing `follow` callback for question-internal updates.
+- Add a second callback for initial question appearance, with a default that delegates to `follow` so existing tests/call sites remain compatible.
+- In `show(q)`, sample the new initial callback before making the question visible or rebuilding the card, then call `scroll(tail)` after `syncPage()` as today.
+- Leave `scroll(true)` in `goBack`, `goForward`, and `goReview` unchanged.
+- Leave existing `scroll(follow())` calls in custom editor changes, option selection, reply, and reject paths unchanged.
+
+2. In `SessionUi.kt`, wire the callbacks with distinct meanings.
+
+- Use `follow = { scroll.following() }` for question-internal updates.
+- Use the new initial callback as `{ scroll.atBottom() }` for initial question appearance.
+- Keep `scroll = { scroll.followBottom(it) }`.
+
+3. Generalize the scroll button pending state for all inline prompt cards.
+
+- Rename `SessionScroll.setQuestionPending` and the backing `question` boolean to a generic name such as `setInputPending` / `pending` or `setAttentionPending` / `pending`.
+- Rename `questionPending(state)` in `SessionUi.kt` to match the broader meaning.
+- Return `true` for non-plan `SessionState.AwaitingQuestion`, `SessionState.AwaitingPermission`, and `SessionState.LoginRequired`.
+- Keep returning `false` for plan follow-up questions so the existing plan-specific icon behavior is preserved.
+- Reuse the existing question-style icon and tooltip for now, unless a separate product decision asks for a different permission/login-specific icon or string.
+
+4. In `SessionScroll.kt`, keep the stale-tail reconciliation in `followBottom(false)`.
+
+- When `follow` is false, increment `seq`, and if the active view is the transcript and `!atBottom()`, set `tail = false` before `updateJump()`.
+- Do not change `following()` to use `atBottom()`, because `tail` is needed to preserve bottom-follow behavior across deferred layout/height growth.
+
+5. Do not add scroll callbacks to `PermissionView`, `LoginRequiredView`, or `BaseQuestionView` unless tests prove the controller-level path is insufficient.
+
+- `PermissionView` and `LoginRequiredView` should remain retained visual views that show/hide themselves and refresh their parent.
+- `BaseQuestionView` should stay a scroll-unaware card shell.
+- The shared behavior for those cards should come from the controller-level state-change follow decision plus the generalized pending-button state.
+
+6. In `SessionScrollTest.kt`, update tests around question-style prompt appearance and preserved behavior.
+
+- Keep or add an assertion that the jump button is visible before emitting a question in the middle-scroll test.
+- Keep a regression for stale `tail` plus visible jump button if no public-only scenario can reproduce the failed state; keep the reflective helper local to this test file and avoid adding production test hooks.
+- Keep existing behavior tests for question navigation from the middle, forced navigation resuming follow, custom question answer growth at bottom, custom question answer growth in the middle, and option selection not resuming follow.
+- Add or keep permission bottom/middle tests to prove `AwaitingPermission` preserves scroll when away from bottom and follows when at bottom.
+- Add or keep login-required bottom/middle tests to prove `LoginRequired` preserves scroll when away from bottom and follows when at bottom.
+- Add explicit button-state assertions for permission and login-required while away from bottom: the button remains visible, switches to the pending-input icon/tooltip, and clicking it still scrolls to bottom.
+- Keep the plan follow-up test proving plan prompts do not switch to the pending-input icon.
+
+7. Add a patch changeset for the JetBrains plugin unless an existing branch changeset is intentionally covering this exact fix.
+
+- Suggested release note: `Preserve JetBrains chat scroll position when inline prompts appear while the scroll button is visible.`
+
+## Verification
+
+- From `packages/kilo-jetbrains/`, run `./gradlew test --tests "ai.kilocode.client.session.SessionScrollTest"`.
+- From `packages/kilo-jetbrains/`, run `./gradlew typecheck`.
+- Do not run root `bun test`.
+
+## Expected Outcome
+
+- If the transcript is away from bottom and the jump button is visible, a newly appearing question, permission prompt, or login-required prompt changes the button state without moving `bar.value`.
+- If the transcript is at bottom, a newly appearing question, permission prompt, or login-required prompt follows to the new bottom.
+- Clicking the visible pending-input scroll button still jumps to the bottom for every inline prompt card.
+- Question carousel next/back/review still jumps to the bottom even if the transcript was previously in the middle.
+- Custom question editor growth still follows when the transcript was following and preserves position when it was not.
@@ -0,0 +1,109 @@
+# Plan: JetBrains Feedback & Support Button
+
+## Goal
+Add the VS Code empty-state `Feedback & Support` affordance to the JetBrains plugin, including a non-modal popup with the same three destinations:
+
+- GitHub issues: `https://github.com/Kilo-Org/kilocode/issues/new/choose`
+- Discord: `https://kilo.ai/discord`
+- Customer support: `https://kilo.ai/support`
+
+The popup must hide when clicking outside or pressing Escape.
+
+## Findings
+
+- The JetBrains empty state is `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/ui/EmptySessionPanel.kt`.
+- It already renders the logo, welcome copy, recents, and `Show History`; this is the right place to add the button.
+- The VS Code implementation is:
+  - Button: `packages/kilo-vscode/webview-ui/src/components/chat/MessageList.tsx`
+  - Popup content: `packages/kilo-vscode/webview-ui/src/components/chat/FeedbackDialog.tsx`
+  - Styling: `packages/kilo-vscode/webview-ui/src/styles/welcome.css`
+- Local IntelliJ API source is available at `$INTELLIJ_REPO=/Users/kirillk/products/intellij-community`.
+- IntelliJ popup API confirmed in local source:
+  - `JBPopupFactory.getInstance().createComponentPopupBuilder(content, focusComponent)`
+  - `setModalContext(false)` for non-modal context
+  - `setRequestFocus(false)` / `setFocusable(false)` if we want the popup not to steal focus
+  - `setCancelOnClickOutside(true)` for outside-click dismissal
+  - `setCancelKeyEnabled(true)` for Escape dismissal
+  - `setCancelOnWindowDeactivation(true)` and `setCancelOnOtherWindowOpen(true)` are available and appropriate for cleanup
+- IntelliJ platform icons found in `AllIcons`:
+  - Feedback button: `AllIcons.Ide.Feedback`
+  - GitHub action: `AllIcons.Vcs.Vendors.Github`
+  - Support/help action: `AllIcons.Actions.Help` or `AllIcons.General.ContextHelp`
+  - Discord: no platform icon found. Add a Discord icon by borrowing the existing VS Code/kilo-ui Discord SVG artwork and adapting it into the JetBrains plugin resources with IntelliJ-compatible SVG colors and dark variant if needed.
+
+## Implementation Steps
+
+1. Add localized JetBrains bundle keys.
+   - Add base English strings to `frontend/src/main/resources/messages/KiloBundle.properties`:
+     - `feedback.button=Feedback & Support`
+     - `feedback.dialog.message=We'd love to hear your feedback or help with any issues you're experiencing.`
+     - `feedback.dialog.github=Report an issue on GitHub`
+     - `feedback.dialog.discord=Join our Discord community`
+     - `feedback.dialog.support=Customer Support`
+     - Reuse existing cancel text if present; otherwise add `common.cancel=Cancel` only if needed.
+   - Add matching keys to localized `KiloBundle_*.properties` files. If accurate translations are not already available from the VS Code i18n files, copy the VS Code translations for matching locales where practical and leave English fallback only if the JetBrains bundle mechanism supports it cleanly.
+
+2. Extend `EmptySessionPanel` UI.
+   - Add a new retained `FeedbackButton`, styled to match VS Code conceptually:
+     - feedback icon + `Feedback & Support` text
+     - dashed link-colored border
+     - transparent background
+     - hand cursor
+     - hover state fills with link color and flips foreground/background for contrast
+   - Use IntelliJ theme APIs instead of raw colors:
+     - link color: `JBUI.CurrentTheme.Link.Foreground.ENABLED`
+     - hover link color: `JBUI.CurrentTheme.Link.Foreground.HOVERED` if useful
+     - editor/panel background from existing session style or `UiStyle.Colors.editorBackground()` / component background
+     - spacing via `UiStyle.Gap` / `JBUI.Borders`
+     - rounded arc via `UiStyle.Arc.component()` or `JBUI.getInt("Button.arc", 6)` at paint time
+   - Add the feedback button below the existing `Show History` button in the empty-state south area, keeping the current centered layout.
+   - Keep Swing mutations on EDT and preserve retained-component behavior.
+
+3. Implement the feedback popup in frontend Swing code.
+   - Add a small popup builder method/class inside `EmptySessionPanel.kt` or a new nearby UI file if the file would become too large.
+    - Content should mirror VS Code:
+      - Kilo logo at top using existing `/icons/kilo-content.svg`
+      - message text
+      - three action buttons/rows for GitHub, Discord, and Customer Support
+      - every action should have an icon: `AllIcons.Vcs.Vendors.Github` for GitHub, the borrowed Discord SVG for Discord, and `AllIcons.Actions.Help` or `AllIcons.General.ContextHelp` for Customer Support
+      - optional Cancel button if it fits the JetBrains UX; Escape/outside click already dismisses
+   - Add the Discord icon asset under `frontend/src/main/resources/icons/` using the plugin's existing icon naming pattern, for example `discord.svg` and `discord_dark.svg` if the borrowed asset needs separate theme variants.
+   - Load the Discord icon with `IconLoader.getIcon("/icons/discord.svg", EmptySessionPanel::class.java)` or a small Kilo-owned icon object if multiple call sites need it.
+   - Use `BrowserUtil.browse(url)` to open links.
+   - Close the popup after opening a URL.
+   - Use `JBPopupFactory.createComponentPopupBuilder(content, null)` and configure:
+     - `.setModalContext(false)`
+     - `.setRequestFocus(false)`
+     - `.setFocusable(false)` unless keyboard tabbing inside popup is desired; if buttons need keyboard focus, use `.setFocusable(true)` with `.setRequestFocus(false)`
+     - `.setCancelOnClickOutside(true)`
+     - `.setCancelKeyEnabled(true)`
+     - `.setCancelOnWindowDeactivation(true)`
+     - `.setCancelOnOtherWindowOpen(true)`
+     - `.setResizable(false)`
+     - `.setMovable(false)`
+   - Show with `popup.showUnderneathOf(feedbackButton)`.
+
+4. Add test coverage in `EmptySessionPanelTest.kt`.
+   - Assert feedback button text uses `KiloBundle.message("feedback.button")`.
+   - Assert feedback button has hand cursor and visible border semantics.
+   - Add an injectable browse callback or popup action callback only if needed for testing without launching browsers; keep it minimal and avoid production-only test hooks if component traversal can exercise enough behavior.
+   - Add a test that clicking the feedback button creates/shows popup content, if feasible in `BasePlatformTestCase`; otherwise test the retained popup content builder/action rows directly through package-internal methods.
+   - Assert the three action labels exist and URL callbacks map to the same URLs as VS Code.
+   - Assert the Discord action has an icon, so the plan cannot regress to a text-only Discord row.
+
+5. Add release note.
+   - This is user-facing for the JetBrains plugin, so add a patch changeset under `.changeset/` unless the repo has a JetBrains-specific release-note mechanism that supersedes changesets.
+   - Suggested text: `Add Feedback & Support to the JetBrains empty session screen.`
+
+6. Verify.
+   - Run the focused frontend/JetBrains tests first, preferably from `packages/kilo-jetbrains/`:
+     - `./gradlew :frontend:test --tests "ai.kilocode.client.session.ui.EmptySessionPanelTest"`
+   - Run JetBrains typecheck from `packages/kilo-jetbrains/`:
+     - `bun run typecheck` or `./gradlew typecheck`
+   - If touching only frontend UI and tests pass, no backend/SDK generation is needed.
+
+## Notes
+
+- Do not add Kotlin UI DSL, Compose, or JCEF.
+- Do not modify shared opencode files; this work is entirely under `packages/kilo-jetbrains/` plus a changeset.
+- Prefer platform icons where available, but explicitly borrow/add the Discord icon because `AllIcons` does not provide one and the popup should match the VS Code button set visually.
@@ -0,0 +1,67 @@
+# JetBrains MdView Editor Theme Colors Plan
+
+## Goal
+
+Keep JetBrains markdown layout compact while making markdown colors and backgrounds come from the active editor color scheme, and ensure existing theme/editor-setting listeners refresh all existing `MdView` instances after changes.
+
+## Findings
+
+- `SessionUi` already subscribes to `EditorColorsManager.TOPIC` and `LafManagerListener.TOPIC`, then calls `applyStyle(SessionEditorStyle.current())` on the session tree.
+- Most markdown consumers already propagate that style through `MdView.applyStyle(style)` via `TextView`, `ReasoningView`, message lists, and session panels.
+- `PlanExitView.applyStyle()` sets only font/code font/foreground and does not call `md.applyStyle(style)`, so internal markdown role colors can stay tied to the initial style.
+- `MdViewHybrid.applyStyle()` restyles retained HTML panes and code block containers, but retained `CodeField` editors need explicit reapplication of `SessionEditorStyle.applyToEditor()` after creation so syntax highlighting and editor colors follow scheme changes.
+- `MdCommon.defaults()` currently mixes editor colors, UI theme colors, and one literal inline-code color fallback. The literal fallback should be removed, and markdown roles should derive from `EditorColorsScheme`/syntax attributes wherever possible.
+- `TextView` currently overrides markdown background with `SessionUiStyle.Transcript.bgColor()` (`UiStyle.Colors.bg()`), while prompt markdown already uses `style.editorBackground`. If markdown surfaces should consistently use editor background, normal text views need to use `style.editorBackground` too.
+
+## Implementation Plan
+
+1. Keep compact CSS unchanged.
+   - Do not reintroduce line-height, margin, padding, heading sizing, or other geometry rules.
+   - Keep the current role color/background selectors only.
+
+2. Derive markdown role defaults from editor settings.
+   - Update `MdCommon.defaults(style)` to use `style.editorForeground` and `style.editorBackground` for primary text/background.
+   - Add small local helper functions for editor attributes, for example foreground/background from `style.editorScheme.getAttributes(key)` and color keys from `style.editorScheme.getColor(key)`.
+   - Use public IntelliJ editor keys for role colors:
+     - Links: `CodeInsightColors.HYPERLINK_ATTRIBUTES.foregroundColor`, fallback to platform link color if absent.
+     - Inline code foreground/background: `DefaultLanguageHighlighterColors.DOC_CODE_INLINE`, fallback to `STRING`, then editor foreground/background.
+     - Code block foreground/background: `DefaultLanguageHighlighterColors.DOC_CODE_BLOCK`, fallback to editor foreground/background.
+     - Quote/emphasis/list weak text: comment/doc-comment attributes, fallback to editor foreground or `UIUtil.getContextHelpForeground()` only when the scheme has no useful value.
+     - Borders/HR/table/code border: editor preview/border color keys such as `EditorColors.PREVIEW_BORDER_COLOR`, fallback to `UiStyle.Colors.contentBorder()`.
+   - Remove `JBColor(0x...)` or other literal runtime color fallbacks from `MdCommon`.
+   - Keep public `MdView` API unchanged; role colors stay internal unless a concrete external override need appears.
+
+3. Ensure style propagation reaches every markdown instance.
+   - Update `PlanExitView.applyStyle(style)` to call `md.applyStyle(style)` before applying its explicit font/code-font/foreground overrides.
+   - Audit existing markdown callers after the change; keep using the existing `SessionEditorStyleTarget` propagation path rather than adding per-`MdView` theme listeners.
+   - Keep explicit foreground overrides in `TextView`, `ReasoningView`, and `PlanExitView` where they intentionally set body text role, but let internal markdown role colors refresh from the new style snapshot.
+
+4. Ensure retained hybrid code blocks update after editor setting changes.
+   - In `MdViewHybrid.CodeView.style(opts)`, for retained `CodeField` blocks, reapply `style.applyToEditor(editor)` to the underlying editor if it exists.
+   - Reapply code editor background/scroll pane/viewport backgrounds from `opts.preBg` in the same path.
+   - Preserve retained component/editor reuse: do not rebuild code block panes just to update style.
+
+5. Align markdown backgrounds with editor settings.
+   - Keep `MdCommon` default background as `style.editorBackground`.
+   - Change normal `TextView` markdown background to `style.editorBackground` if the intent is that all markdown surfaces use editor background, matching `PromptView` and session root behavior.
+   - Preserve `transparent` handling: when `md.opaque = false`, background should still be the editor-derived value for child/code surfaces, but the Swing component should remain non-opaque.
+
+6. Update tests.
+   - Extend `MdViewTest` to verify markdown role CSS changes when applying a `SessionEditorStyle` backed by a customized editor scheme, especially inline code, code block, link, and border colors.
+   - Extend `MdViewHybridTest` to assert `applyStyle()` updates retained HTML panes and retained code editors without replacing them, including editor scheme/background changes.
+   - Add or extend `PlanExitViewTest` so `applyStyle()` refreshes the nested markdown style, not just foreground/font overrides.
+   - Keep existing compactness expectations: tests should not assert new spacing, padding, margin, line-height, or size rules.
+
+## Verification
+
+- From `packages/kilo-jetbrains/`, run `./gradlew frontend:test --tests '*MdView*'`.
+- From `packages/kilo-jetbrains/`, run `./gradlew frontend:test --tests '*PlanExitViewTest*'` if the focused test is not covered by the MdView filter.
+- From `packages/kilo-jetbrains/`, run `bun run typecheck`.
+
+## Constraints
+
+- Do not introduce JCEF, Compose, or Kotlin UI DSL.
+- Do not add new theme/editor listeners in `MdView`; use the existing `SessionUi` listener and `SessionEditorStyleTarget` propagation path.
+- Avoid hardcoded runtime colors in markdown styling; prefer editor scheme attributes/color keys, then platform/theme APIs as non-literal fallbacks.
+- Preserve retained Swing behavior and `MdViewHybrid.sync()` component reuse.
+- Keep the public `MdView` override API stable unless implementation proves a new external override is required.
@@ -0,0 +1,69 @@
+# JetBrains MdView VS Code Styling Plan
+
+## Goal
+
+Improve JetBrains markdown output so assistant/user transcript markdown visually matches the VS Code webview markdown style while keeping the existing Swing/JBHtmlPane + editor-backed code block architecture.
+
+## Findings
+
+- VS Code markdown styling is split across `packages/ui/src/components/markdown.css`, `packages/kilo-ui/src/components/markdown.css`, `packages/kilo-ui/src/styles/vscode-bridge.css`, and message-part overrides.
+- Base VS Code markdown uses 14px sans text, 160% line height, tight first/last margins, same-size medium headings, 12px paragraph spacing, link-colored anchors, compact lists, weak list markers, weak blockquotes with a 2px left border, invisible HR spacing, bordered/padded code blocks, green inline code, and lightly bordered tables.
+- The VS Code theme bridge maps markdown roles to editor/theme tokens: heading/link/list/image use `textLinkForeground`, text/strong/code-block use editor foreground, inline code uses charts/syntax green, quote/emphasis use description foreground, HR uses panel border.
+- JetBrains markdown is rendered by `MdViewHybrid` and `MdViewHtmlPane`, with shared CSS from `MdCommon.rules()` and defaults from `MdCommon.defaults()`.
+- JetBrains currently styles only broad tag font/color, links, code/pre colors, blockquote border/text color, and table border. It lacks VS Code-equivalent spacing, heading/strong/emphasis/list marker/table cell rules, inline-code foreground, blockquote geometry, HR spacing, and code block surface polish.
+- JetBrains fenced code blocks are already stronger than VS Code in one respect: they use `EditorTextField` with real IDE syntax highlighting and streaming retention. Preserve this instead of switching to web/JCEF rendering.
+
+## Implementation Plan
+
+1. Expand JetBrains markdown style tokens.
+   - Add internal fields to `MdStyle` for heading, strong, emphasis, inline code foreground, list marker, HR, table/header, and code block border colors.
+   - Keep the public `MdView` override API stable unless a new external override is clearly needed.
+   - Compute defaults in `MdCommon.defaults(style)` from IntelliJ/editor theme sources and centralized Kilo semantic colors where no platform key matches.
+   - Use `JBColor.namedColor("Kilo.Markdown.*", fallback)` for Kilo-specific markdown palette fallbacks, so themes can override them and runtime code avoids scattered hardcoded colors.
+
+2. Mirror VS Code markdown CSS in `MdCommon.rules()`.
+   - Add root/body wrapping rules: max width behavior, break-word wrapping, base line-height, and first/last-child margin trimming where supported by `JBHtmlPane` CSS.
+   - Add heading rules: same base size, medium/bold weight, role-specific color, line height, and bottom spacing.
+   - Add paragraph, list, list item, nested list, and marker rules. If Swing HTML does not support `::marker`, fall back to `li { color: ... }` plus child text color reset only if supported; otherwise keep list text normal and document the limitation in tests.
+   - Add strong/emphasis colors matching VS Code token roles.
+   - Add anchor styling matching VS Code: themed link color, no forced background, and underline behavior where `JBHtmlPane` supports it.
+   - Add blockquote geometry: 2px left border, 24px vertical margin, 8px left padding, weak text, and normal style.
+   - Add table layout rules: collapse borders, full width where possible, 24px vertical margin, 12px cell padding, weak row borders, stronger header text.
+   - Keep HRs visually hidden but spaced consistently with VS Code if the renderer includes them. `MdViewHybrid` currently filters thematic breaks, so this mainly benefits `MdViewHtmlPane` and future reuse.
+   - Add inline-code foreground and medium font weight. Avoid inline code backgrounds unless the current `JBHtmlPane` configuration already draws them acceptably.
+
+3. Polish JetBrains code block containers without losing IDE highlighting.
+   - Keep `EditorTextField` for fenced/indented blocks and `JBTextArea` fallback.
+   - Style `JBScrollPane` code blocks to match VS Code’s `markdown-code` wrapper feel: subtle background, subtle border, rounded-ish platform arc if feasible, 12px-ish padding, and thin horizontal scrollbar behavior.
+   - Use `SessionUiStyle.View.Code` for geometry constants. Add only minimal new constants there if current values cannot represent the VS Code spacing.
+   - Separate code block border color from table border internally so table styling can change without affecting code boxes.
+   - Continue applying `SessionEditorStyle.applyToEditor(ed)` so code blocks follow IDE syntax highlighting and editor font changes.
+
+4. Add file/path affordance parity where safe.
+   - For markdown links whose `href` looks like a relative file path, keep existing link dispatch so the current caller can open files/URLs appropriately.
+   - Consider decorating inline code that looks like a path with a `file-link` class only when an `openFile` callback is available through the existing usage path. If the current `MdView` abstraction only has `openUrl`, do not widen it unless the call sites can pass file opening cleanly.
+   - At minimum, make inline code/path-looking content visually closer to VS Code by using the inline-code foreground and dotted underline for explicit file links where generated HTML contains link/code classes.
+
+5. Preserve retained Swing behavior.
+   - Keep `MdViewHybrid.sync()` prefix reuse logic unchanged unless necessary.
+   - Ensure style updates call `reloadCssStylesheets()` and reassign text only for retained `JBHtmlPane` blocks, not by rebuilding all blocks.
+   - Keep streaming fenced-code fast path and editor disposal behavior intact.
+
+6. Add focused tests.
+   - Extend `MdViewTest` and/or `MdViewHybridTest` to assert `overrideSheet()` contains the new VS Code-equivalent rules for headings, strong/emphasis, links, inline code foreground, list/table/blockquote spacing, HR, and code block/table border separation.
+   - Add component tests for code block pane styling: background, viewport background, border color, padding, scrollbar policy, and retained editor instance after `applyStyle()`.
+   - Keep existing stress/leak tests green. Add a small stress assertion only if the implementation changes style application semantics.
+   - Add a changeset: `@kilocode/kilo-jetbrains` patch with user-facing wording such as `Improve markdown readability in JetBrains chat transcripts.`
+
+## Verification
+
+- Run targeted JetBrains markdown tests first from `packages/kilo-jetbrains/`: `./gradlew frontend:test --tests '*MdView*'` if the Gradle module supports it; otherwise run the closest supported targeted Gradle test command.
+- Run `bun run typecheck` from `packages/kilo-jetbrains/`.
+- If targeted Gradle filtering is unreliable, run `./gradlew test` from `packages/kilo-jetbrains/`.
+
+## Constraints
+
+- Do not introduce JCEF, Compose, or Kotlin UI DSL.
+- Keep changes inside `packages/kilo-jetbrains/` and `.changeset/` unless a shared Kilo UI source of truth is explicitly required.
+- No `kilocode_change` markers are needed for JetBrains or Kilo UI paths.
+- Prefer IntelliJ theme APIs and centralized semantic tokens over scattered literal colors.
@@ -0,0 +1,63 @@
+# JetBrains Session UI Icons And Header Layout Plan
+
+## Goal
+Improve JetBrains session UI icon consistency and reduce accidental header interactions:
+- Use Kilo/VS Code-aligned session icons in session views.
+- Fix the reasoning header icon.
+- Normalize session part collapse/expand chevrons so collapsed/expanded states do not jump between differently sized glyphs.
+- Move the session-details toggle away from compaction and place it before the session title.
+
+## Findings
+- Session view icons are centralized in `packages/kilo-jetbrains/frontend/src/main/kotlin/ai/kilocode/client/session/views/SessionViewIcons.kt` and loaded from `frontend/src/main/resources/icons/views/*.svg`.
+- The JetBrains `views` SVGs already mirror the shared VS Code/UI icon paths from `packages/ui/src/components/icon.tsx` for the audited names, including `brain`, `chevron-down`, `chevron-right`, `checklist`, `console`, `warning`, etc.
+- The reasoning view currently renders `SessionViewIcons.eye` in `ReasoningView.kt`; VS Code/shared UI uses the `brain` icon for reasoning/thinking surfaces, and `SessionViewIcons.brain` already exists.
+- Standard collapsible session parts use `SessionViewIcons.chevronDown` when expanded and `SessionViewIcons.chevronRight` when collapsed in `AbstractSessionPartView.kt`; `QuestionResultView.kt` repeats this pattern manually. The down/right SVG paths have different visual extents.
+- The session header currently places the details toggle next to the compact button in the right-side controls in `SessionHeaderPanel.kt`, making the two actions easy to confuse.
+
+## Implementation Steps
+1. **Keep icon sources aligned with VS Code/shared UI**
+   - Treat `packages/ui/src/components/icon.tsx` as the source for Kilo web/session glyph shapes.
+   - Re-check `SessionViewIcons.kt` entries against available JetBrains assets; only update or add SVGs if a session view uses a Kilo icon missing from `frontend/src/main/resources/icons/views/`.
+   - Preserve JetBrains SVG theming rules: no `currentColor`; use literal palette colors and dark variants where assets are added or changed.
+
+2. **Fix reasoning icon**
+   - In `ReasoningView.kt`, change the reasoning header glyph from `SessionViewIcons.eye` to `SessionViewIcons.brain`.
+   - Add or update test coverage in `ReasoningViewTest.kt` by inspecting the rendered Swing label tree and asserting the reasoning icon is `SessionViewIcons.brain`.
+
+3. **Normalize collapse/expand chevrons for session parts**
+   - Stop using the mixed `chevronRight`/`chevronDown` pair for collapsible session content.
+   - Use a single base Kilo chevron glyph for both states, matching the current custom chevron used by the session header (`/icons/chevron-down.svg` / equivalent `SessionViewIcons.chevronDown`).
+   - Add a shared rotated icon for the opposite state instead of switching to a differently sized right-facing asset. Prefer a small reusable helper or centralized icon field rather than importing header-specific UI into session views.
+   - Update `AbstractSessionPartView.kt` and `QuestionResultView.kt` to use the normalized chevron pair.
+   - Leave `QuestionView.kt` navigation chevrons alone unless auditing shows they are being used for collapse/expand; those are previous/next controls, not expand/collapse controls.
+
+4. **Relocate and change header show/hide details toggle**
+   - In `SessionHeaderPanel.kt`, replace the custom header details chevron with platform `AllIcons` arrows/chevrons, e.g. collapsed = `AllIcons.General.ArrowRight`, expanded = `AllIcons.General.ArrowDown`.
+   - Move the details toggle out of the right-side controls and into `BorderLayout.WEST` of the header row.
+   - Rebuild the top header as:
+     - outer border layout
+     - west: details toggle button
+     - center: inner border layout
+     - inner center: session title
+     - inner east: horizontal stack/row with price/context and compact button
+   - Remove the details toggle from the right-side row so compaction remains visually separate from show/hide details.
+   - Keep existing tooltip/accessibility strings and expansion persistence behavior unchanged.
+
+5. **Tests**
+   - Update `SessionHeaderPanelTest.kt` to assert:
+     - collapsed/expanded header details icons use the selected `AllIcons` constants;
+     - the details toggle persists expansion state as before;
+     - the details toggle is parented/laid out separately from the compact button.
+   - Update `AbstractSessionPartViewTest.kt` to assert collapsible parts keep the same icon dimensions across collapsed/expanded states and no longer use the mismatched right/down pair.
+   - Update `QuestionResultViewTest.kt` similarly because it has its own chevron implementation.
+   - Update `ReasoningViewTest.kt` for the brain icon.
+
+6. **Verification**
+   - Run the smallest relevant JetBrains checks from `packages/kilo-jetbrains/`:
+     - `./gradlew test --tests "ai.kilocode.client.session.views.ReasoningViewTest" --tests "ai.kilocode.client.session.views.base.AbstractSessionPartViewTest" --tests "ai.kilocode.client.session.views.QuestionResultViewTest" --tests "ai.kilocode.client.session.ui.header.SessionHeaderPanelTest"`
+     - `./gradlew typecheck`
+   - If the filtered Gradle test syntax is not accepted by the project, run `./gradlew test` from `packages/kilo-jetbrains/` instead.
+
+## Notes
+- No shared upstream `opencode` files are involved; changes stay under `packages/kilo-jetbrains/`.
+- A changeset may be needed because this is user-facing JetBrains UI polish; confirm existing changeset policy for the private JetBrains package during implementation.
@@ -0,0 +1,172 @@
+---
+name: release-jetbrains
+description: Use when releasing the Kilo JetBrains plugin -- resolve a version ("next rc" or explicit), run the prepare workflow, edit and commit a filtered human-readable changelog on the release PR, then watch publish to completion.
+---
+
+# JetBrains Release
+
+Use this skill when releasing the Kilo JetBrains plugin.
+
+This skill drives the existing JetBrains release workflows. It must not move, delete, or recreate JetBrains release tags. It must always confirm the resolved version with the user before dispatching the prepare workflow because the prepare workflow creates an immutable `jetbrains/v<version>` tag.
+
+## Preconditions
+
+- Run from the repository root.
+- `gh` must be authenticated for `Kilo-Org/kilocode` with permission to dispatch workflows, read PRs, and write contents. Merge permission is only required if the user asks the skill to merge the release PR automatically.
+- Check auth with `gh auth status`. For GitHub CLI OAuth, refresh common release scopes with `gh auth refresh -s repo -s workflow`; `repo` covers private-repo contents and PR operations, and `workflow` allows workflow dispatch. If using a fine-grained token instead, grant repository permissions for Actions read/write, Contents read/write, and Pull requests read/write. Merging still requires normal repository collaborator permission or a token/user allowed by branch protection.
+- Reference `packages/kilo-jetbrains/RELEASING.md` for manual recovery rules.
+- Do not locally check out the generated release branch. The helper scripts update the release branch through GitHub to avoid disturbing the current worktree.
+
+## Version Resolution
+
+Resolve the user's version request:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/resolve-version.ts --spec "next rc"
+```
+
+Accepted specs:
+
+| Spec | Meaning |
+|---|---|
+| `next rc` | If the latest JetBrains tag is an RC, increment its `rc.n`; otherwise start the next patch RC at `rc.1`. |
+| `next stable` | If the latest JetBrains tag is an RC, use its base version; otherwise use the next patch stable. |
+| `x.y.z-rc.n` | Explicit RC release. |
+| `x.y.z` | Explicit stable release. |
+
+Show the resolved `version`, `kind`, and default `fromTagDefault` to the user and ask for confirmation before continuing.
+
+## Prepare Workflow
+
+After confirmation, dispatch and watch the prepare workflow:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/dispatch-prepare.ts --kind rc --version 7.0.1-rc.7
+```
+
+Pass a generous Bash timeout, such as `1800000` ms, because the script blocks on `gh run watch --exit-status`. If the shell times out but the workflow is still running, re-attach with:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/dispatch-prepare.ts --kind rc --version 7.0.1-rc.7 --run-id <run-id>
+```
+
+The script prints `prNumber`, `prUrl`, `runUrl`, and `branch` on success. Immediately show the `prUrl` to the user so they can open the release PR without asking for it later.
+
+## Changelog Draft
+
+Create a changelog draft after the prepare PR exists:
+
+1. Read the PR body with `gh pr view <pr> --json body`.
+2. Extract `JetBrains-From-Tag`, `JetBrains-Tag`, and `## Generated Notes`.
+3. Fetch the release range tags if they are missing locally:
+
+```bash
+git fetch origin refs/tags/<from-tag>:refs/tags/<from-tag> refs/tags/<tag>:refs/tags/<tag>
+```
+
+4. Use the release range and path filter as the primary relevance signal:
+
+```bash
+git log --oneline <from-tag>..<tag> -- packages/opencode packages/kilo-jetbrains
+```
+
+Keep JetBrains and CLI/runtime changes. Drop unrelated VS Code, docs, gateway, telemetry, i18n, desktop, and webview-only changes unless they affect the CLI bundled into the JetBrains plugin.
+
+Rewrite terse commit or PR titles into user-facing bullets grouped under `### Added`, `### Fixed`, and `### Changed`. Keep the exact generated header format:
+
+```markdown
+## [<version>] - <date>
+```
+
+Write the editable draft to:
+
+```text
+packages/kilo-jetbrains/build/release/<version>-changelog.md
+```
+
+Include source context in an HTML comment so it is easy to edit but not shipped:
+
+```markdown
+<!-- CONTEXT - deleted automatically on commit. Source PRs in range:
+- #1234 feat(jetbrains): ... https://github.com/Kilo-Org/kilocode/pull/1234
+- #1235 fix(cli): ... https://github.com/Kilo-Org/kilocode/pull/1235
+-->
+```
+
+Ask the user to edit the file and confirm when done.
+
+## Commit Changelog
+
+After the user confirms the draft is ready, strip the `<!-- CONTEXT ... -->` block into a temporary cleaned file, then commit the cleaned section to the release branch:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/update-changelog.ts --version 7.0.1-rc.7 --file /path/to/clean-section.md
+```
+
+The script updates `packages/kilo-jetbrains/CHANGELOG.md` on `jetbrains/release/v<version>` through the GitHub contents API and commits with:
+
+```text
+docs(jetbrains): edit changelog for v<version>
+```
+
+If `update-changelog.ts` fails with `gh: Not Found (HTTP 404)`, verify the release branch and changelog path with:
+
+```bash
+gh api "repos/Kilo-Org/kilocode/contents/packages/kilo-jetbrains/CHANGELOG.md?ref=jetbrains/release/v<version>"
+```
+
+Then either fix and retry the helper, or perform the equivalent contents API update using `ref` in the query string.
+
+After the changelog commit succeeds, show the release PR URL again and tell the user that the PR needs manual approval and merge before publishing can continue.
+
+## Approve And Publish
+
+Ask the user to approve the release changelog and metadata. Before merging or publishing, verify the PR approval and required checks are green:
+
+```bash
+gh pr view <pr> --json mergeStateStatus,reviewDecision,statusCheckRollup
+gh pr checks <pr> --watch --interval 10
+```
+
+Do not merge or publish while required checks are failing unless the user explicitly gives a maintainer override.
+
+If a required check fails from an apparent flake, rerun only the failed jobs and wait for the run to finish:
+
+```bash
+gh run rerun <run-id> --failed
+gh run watch <run-id> --exit-status
+```
+
+By default, have the user merge the release PR manually in GitHub, then watch the publish workflow:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7
+```
+
+Only merge automatically when the user explicitly asks for it and `gh` has merge permission:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7 --merge
+```
+
+Pass a generous Bash timeout, such as `1800000` ms. If the shell times out, re-attach with:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version 7.0.1-rc.7 --run-id <run-id>
+```
+
+If `watch-publish.ts --merge` reports that the PR is already merged, or a transient GitHub API `5xx` interrupts publish-run discovery, rerun without `--merge`:
+
+```bash
+bun .kilo/skills/release-jetbrains/script/watch-publish.ts --pr <number> --version <version>
+```
+
+Report the Marketplace channel and GitHub Release URL. RC versions publish to the `eap` channel; stable versions publish to the default Marketplace channel.
+
+## Recovery
+
+- If prepare created the tag but failed before creating a PR, rerun prepare for the same version. The existing workflow reuses the tag if it points to the same commit.
+- If a tag points to an unexpected SHA, stop and inspect manually. Do not move or delete release tags casually.
+- If release PR checks fail from an apparent flake, use `gh run rerun <run-id> --failed`, then `gh run watch <run-id> --exit-status` before publishing.
+- If publish fails after merge, rerun the failed workflow only if Marketplace did not already accept the version.
+- If Marketplace succeeds but GitHub Release upload fails, manually create or edit the GitHub Release for `jetbrains/v<version>` using the reviewed changelog.
@@ -0,0 +1,75 @@
+#!/usr/bin/env bun
+
+import { $ } from "bun"
+import { parseArgs } from "util"
+
+const repo = process.env.GH_REPO ?? process.env.GITHUB_REPOSITORY ?? "Kilo-Org/kilocode"
+const workflow = "prepare-jetbrains-release.yml"
+const { values } = parseArgs({
+  args: Bun.argv.slice(2),
+  options: {
+    kind: { type: "string" },
+    version: { type: "string" },
+    "from-tag": { type: "string" },
+    "run-id": { type: "string" },
+    help: { type: "boolean", short: "h", default: false },
+  },
+})
+
+if (values.help) {
+  console.log(
+    `Usage: bun .kilo/skills/release-jetbrains/script/dispatch-prepare.ts --kind <rc|stable> --version <version> [--from-tag <tag>] [--run-id <id>]`,
+  )
+  process.exit(0)
+}
+
+const kind = values.kind
+const ver = values.version
+const branch = `jetbrains/release/v${ver}`
+
+if (kind !== "rc" && kind !== "stable") throw new Error("--kind must be rc or stable")
+if (!ver) throw new Error("--version is required")
+
+const id = values["run-id"] ?? (await dispatch())
+const url = `https://github.com/${repo}/actions/runs/${id}`
+
+console.log(`prepareRunId=${id}`)
+console.log(`runUrl=${url}`)
+
+await $`gh run watch ${id} --repo ${repo} --exit-status`
+
+const pr = (await $`gh pr view ${branch} --repo ${repo} --json number,url`.json()) as { number: number; url: string }
+console.log(
+  JSON.stringify(
+    {
+      prNumber: pr.number,
+      prUrl: pr.url,
+      runUrl: url,
+      branch,
+    },
+    null,
+    2,
+  ),
+)
+
+async function dispatch() {
+  const before = new Set((await runs()).map((run) => run.databaseId))
+  const args = ["workflow", "run", workflow, "--repo", repo, "-f", `kind=${kind}`, "-f", `version=${ver}`]
+  if (values["from-tag"]) args.push("-f", `from_tag=${values["from-tag"]}`)
+  await $`gh ${args}`
+
+  for (const _ of Array.from({ length: 60 })) {
+    const run = (await runs()).find((item) => !before.has(item.databaseId))
+    if (run) return String(run.databaseId)
+    await Bun.sleep(1000)
+  }
+  throw new Error(`No new ${workflow} run appeared after dispatch`)
+}
+
+async function runs() {
+  return (await $`gh run list --repo ${repo} --workflow ${workflow} --event workflow_dispatch --json databaseId,createdAt,status --limit 100`.json()) as {
+    databaseId: number
+    createdAt: string
+    status: string
+  }[]
+}
--- a/Show More
+++ b/Show More