Changelog

CLI

Patch Changes

• #15383 82926fb - Restrict browser links and MCP OAuth authorization URLs to HTTP(S), and fix unsafe URL handling on Windows and WSL.

• #15365 c7b9c36 - Block compromised eMudhra certificate chains with a fixed, pinned Bun runtime on all CLI platforms. Keep Nix CLI builds compatible with the pinned runtime.

• #15293 2e17931 - Treat shell expressions in MCP prompts as literal text instead of executing them locally.

• #15350 4481e06 - Restore session pull request badges when remote control is disabled.

• #15351 2f452d7 - Add an internal Session Host registry and the built-in Kilo Cloud provider that lists, reads, starts, and describes cloud-hosted sessions.

Added

• Added project-scoped agent usage aggregation to the bundled CLI, backed by a pageable agent usage HTTP API.
• Added custom auto routers with client models and local evals.
• Added a session host registry and Kilo Cloud session adapter.
• Agent Manager now fetches the base branch before creating new worktrees.

Fixed

• Kept the prompt navigator in sync with the hovered stripe and stopped following the prompt after manual scrolling.
• Preserved MCP prompt content so server-provided prompts render correctly.
• Kept edit tools available to subagents of allowlist callers.
• Mapped audio formats correctly in custom router decision input.
• Ingested PR links without requiring remote control.

Changed

• Bumped the bundled Kilo CLI pin to v7.8.15 (via v7.8.14).

VS Code

7.8.15

Patch Changes

• #15235 c61a974 - Let the browser_open permission prompt remember your choice. The prompt now offers the current origin and all origins as always-allow rules, and Auto-Approve settings list browser_open so you can allow Integrated Browser navigation without answering each request.

7.8.13

Minor Changes

• #14866 f01b273 - Let a primary agent choose which agent runs an Agent Manager session it starts, so a session fanned out through Agent Manager can run a custom agent (and its edit/bash/MCP permission rules) instead of always falling back to the workspace default agent.

• #15119 cbdb045 - Redesign the Agent Manager New Worktree dialog. Pick the base branch next to the project, set an optional branch name next to the worktree name, and choose versions next to the Create button. The Advanced options section is gone. The base branch pick is kept as a draft until you create the worktree, and you can make it the project default from the branch picker. Branch pickers also open faster in repositories with many branches.

Patch Changes

• #14866 e703b56 - Reject internal agents when an agent starts an Agent Manager session for a named agent, and list the selectable agents on every rejection so a wrong name can be corrected without guessing.

• #15118 33e6701 - Align brand yellow hover colors with Anaconda.

• #15104 0f4936d - Keep Gemini thought signatures and other OpenRouter reasoning details that arrive late in a response, so later requests in the conversation replay them

• #14942 b7672ae - Show why a provider failed to load — such as rejected credentials or a network error — instead of silently hiding it from the provider list. The CLI, TUI, and VS Code model picker now surface the reason and offer to sign in again when credentials were rejected.

• #15041 32bc724 Thanks @hdcodedev! - Send review comments from the Changes view to the chat when the sidebar is showing History.

• #14774 0913273 Thanks @LEN5010! - Prevent restarted Agent Manager terminals from lingering after closing the terminal or reloading the panel.

• #15113 ba0410f - Update the VS Code extension brand yellow to #FFDD00.

• #14925 4516a48 Thanks @abdulhusainahk! - Show a dismissible hint naming the first workspace folder used by chat in multi-root windows, with guidance for working on another folder. The hint is available in all supported sidebar languages.

• #15045 6fcbc66 Thanks @hdcodedev! - Keep new files with accented or non-Latin names, such as résumé.txt, when moving a chat to a worktree

CLI

7.8.15

Minor Changes

• #15183 61e311c - Route kilo-auto/custom/<slug> auto routers on the client: the CLI registers its own provider models as router entries (kilo auto router add|remove|list), asks the auto-routing service for a decision when it can serve one of them, and runs the picked model locally. kilo auto eval <router> runs the missing client evals in Docker and uploads each result as it finishes.

Patch Changes

• #15235 c61a974 - Let the browser_open permission prompt remember your choice. The prompt now offers the current origin and all origins as always-allow rules, and Auto-Approve settings list browser_open so you can allow Integrated Browser navigation without answering each request.

• #15254 705b5d6 - Restore edit and write for subagents delegated by an agent that allows edits on specific paths. The subagent's own edit allowlist now governs instead of inheriting a blanket edit deny.

7.8.13

Minor Changes

• #15159 7420e70 - Share the agents a remote-controlled CLI can run, including project agents from .kilo/agents, so the Kilo mobile app can offer them when it starts or continues a session on that computer.

Patch Changes

• #15114 f1927fb - Use the Kilo brand yellow (#FFDD00) for the CLI logo and theme accent.

• #14866 0c8849c - Allow custom agents to delegate file edits to subagents without stripping the subagent's configured write permissions. A custom delegator's own edit rules, including path-scoped denies such as edit: { "secrets/**": "deny" }, now apply only to that agent and no longer constrain the subagents it starts, so use a session-level edit restriction to confine delegated writes. Built-in read-only modes (plan, ask, orchestrator) still block edits in their subagents, and child agents keep their own denials and approval requirements.

• #13722 952d2d1 Thanks @maphew! - Restore Home and End cursor movement while typing in dialog filter inputs (e.g. the provider connect, session list, and model picker dialogs) instead of jumping the list, and keep the list-jump behavior when the filter is empty.

• #15131 f9b632f - Refresh an expired MCP OAuth token automatically. Servers that reject an expired access token with 403 (rather than 401) no longer leave the connection stuck on "authentication required", so a new worktree or project session reconnects without asking you to sign in again.

• #13260 8d5c126 Thanks @waewoo! - Allow OpenAI-compatible providers that require string content for tool calls to opt in without changing the default request format.

• #15104 0f4936d - Keep Gemini thought signatures and other OpenRouter reasoning details that arrive late in a response, so later requests in the conversation replay them

• #14942 b7672ae - Show why a provider failed to load — such as rejected credentials or a network error — instead of silently hiding it from the provider list. The CLI, TUI, and VS Code model picker now surface the reason and offer to sign in again when credentials were rejected.

• #15124 a85b9a8 - Preserve session status timing for accurate overnight activity and blocker reporting.

• #15180 ec376c5 - Keep stray console output from dependencies out of the TUI. Warnings written straight to the terminal by libraries running in the session worker — for example the MCP SDK's notice about OAuth tokens saved without an issuer — used to land on top of the rendered screen and stay there until a redraw, leaving the splash screen or chat view shredded. Those writes now go to the log file instead.

VS Code

Minor Changes

• #14866 f01b273 - Let a primary agent choose which agent runs an Agent Manager session it starts, so a session fanned out through Agent Manager can run a custom agent (and its edit/bash/MCP permission rules) instead of always falling back to the workspace default agent.

• #15119 cbdb045 - Redesign the Agent Manager New Worktree dialog. Pick the base branch next to the project, set an optional branch name next to the worktree name, and choose versions next to the Create button. The Advanced options section is gone. The base branch pick is kept as a draft until you create the worktree, and you can make it the project default from the branch picker. Branch pickers also open faster in repositories with many branches.

Patch Changes

• #14866 e703b56 - Reject internal agents when an agent starts an Agent Manager session for a named agent, and list the selectable agents on every rejection so a wrong name can be corrected without guessing.

• #15118 33e6701 - Align brand yellow hover colors with Anaconda.

• #15104 0f4936d - Keep Gemini thought signatures and other OpenRouter reasoning details that arrive late in a response, so later requests in the conversation replay them

• #14942 b7672ae - Show why a provider failed to load — such as rejected credentials or a network error — instead of silently hiding it from the provider list. The CLI, TUI, and VS Code model picker now surface the reason and offer to sign in again when credentials were rejected.

• #15041 32bc724 Thanks @hdcodedev! - Send review comments from the Changes view to the chat when the sidebar is showing History.

• #14774 0913273 Thanks @LEN5010! - Prevent restarted Agent Manager terminals from lingering after closing the terminal or reloading the panel.

• #15113 ba0410f - Update the VS Code extension brand yellow to #FFDD00.

• #14925 4516a48 Thanks @abdulhusainahk! - Show a dismissible hint naming the first workspace folder used by chat in multi-root windows, with guidance for working on another folder. The hint is available in all supported sidebar languages.

• #15045 6fcbc66 Thanks @hdcodedev! - Keep new files with accented or non-Latin names, such as résumé.txt, when moving a chat to a worktree

CLI

Minor Changes

• #15159 7420e70 - Share the agents a remote-controlled CLI can run, including project agents from .kilo/agents, so the Kilo mobile app can offer them when it starts or continues a session on that computer.

Patch Changes

• #15114 f1927fb - Use the Kilo brand yellow (#FFDD00) for the CLI logo and theme accent.

• #14866 0c8849c - Allow custom agents to delegate file edits to subagents without stripping the subagent's configured write permissions. A custom delegator's own edit rules, including path-scoped denies such as edit: { "secrets/**": "deny" }, now apply only to that agent and no longer constrain the subagents it starts, so use a session-level edit restriction to confine delegated writes. Built-in read-only modes (plan, ask, orchestrator) still block edits in their subagents, and child agents keep their own denials and approval requirements.

• #13722 952d2d1 Thanks @maphew! - Restore Home and End cursor movement while typing in dialog filter inputs (e.g. the provider connect, session list, and model picker dialogs) instead of jumping the list, and keep the list-jump behavior when the filter is empty.

• #15131 f9b632f - Refresh an expired MCP OAuth token automatically. Servers that reject an expired access token with 403 (rather than 401) no longer leave the connection stuck on "authentication required", so a new worktree or project session reconnects without asking you to sign in again.

• #13260 8d5c126 Thanks @waewoo! - Allow OpenAI-compatible providers that require string content for tool calls to opt in without changing the default request format.

• #15104 0f4936d - Keep Gemini thought signatures and other OpenRouter reasoning details that arrive late in a response, so later requests in the conversation replay them

• #14942 b7672ae - Show why a provider failed to load — such as rejected credentials or a network error — instead of silently hiding it from the provider list. The CLI, TUI, and VS Code model picker now surface the reason and offer to sign in again when credentials were rejected.

• #15124 a85b9a8 - Preserve session status timing for accurate overnight activity and blocker reporting.

• #15180 ec376c5 - Keep stray console output from dependencies out of the TUI. Warnings written straight to the terminal by libraries running in the session worker — for example the MCP SDK's notice about OAuth tokens saved without an issuer — used to land on top of the rendered screen and stay there until a redraw, leaving the splash screen or chat view shredded. Those writes now go to the log file instead.

VS Code

7.8.12

Minor Changes

• #15030 d749650 - Route Kilo Gateway traffic (chat, models, embeddings, autocomplete, transcription) through https://ai-gateway.kilo.ai/api/v1 by default, and support a KILO_AI_GATEWAY_URL environment variable to override it. Setting only KILO_API_URL keeps routing gateway traffic through that server.

7.8.10

Minor Changes

• #14988 9a55ea4 Thanks @WebReflection! - Add an experimental Search Ignored Paths setting that lists ignored folders or files, such as build output, that the agent's glob tool should still search

Patch Changes

• #15017 e48c978 Thanks @WebReflection! - Keep .gitignored files and folders, such as node_modules, out of glob results and grep include searches, even when the pattern matches folder names, like **/*

• #15056 0e6da31 - Fix grep failing with "Invalid ripgrep match output" when matched lines aren't valid UTF-8, such as in ISO-8859-1 / Windows-1252 encoded files

7.8.9

Minor Changes

• #14928 6522b4a - Reorder projects in the Agent Manager sidebar with drag and drop. The order is kept after a restart.

• #14919 69ec588 - Open chat links in the system browser with Shift-click when the Integrated Browser handles link clicks

• #14900 9b8a58f - Support opening the current Integrated Browser page in the external default browser

• #14927 a023122 - Show the agent, model, and reasoning selectors as one split control in the prompt toolbar and the Agent Manager New Worktree dialog. While one picker is open, move the pointer to another part to switch to it, or use the Left and Right arrow keys. The reasoning level shows only when it is set and there is room. Otherwise it collapses into the trailing arrow, and a changed level shows for a moment. On narrow sidebars, less used actions move into a "More actions" menu one at a time, while voice input and send stay visible. The toolbar always stays one row, so a long model name truncates and does not hide actions.

Patch Changes

• #14896 064bb13 - Align the loading spinner with the subagent identicon. The spinner now uses the same 5x5 dot grid as subagent avatars, so loading and subagent indicators share one cell layout. The four corner cells stay empty and the same twinkle animation is kept.

• #14899 7cf9fdc - Move the agent board button next to the background agents above the prompt. It shows the latest posts and marks new ones, and stays available after agents are cleared or the window reloads.

• #14898 5afa419 - Match the Integrated Browser color scheme to the current IDE theme so pages that support prefers-color-scheme render in dark or light to match the editor.

• #14893 3249118 Thanks @madrugado! - Retry provider connection resets (Connection reset by server) through the normal retry path with backoff instead of pausing the session waiting for network reconnection. Connection resets are transient server-side failures when the error is marked retryable; only genuine network disconnections still trigger the offline wait.

• #14738 d9f9d72 Thanks @brunoagatao! - Fix permission prompts from subagents failing with "Failed to update permissions" and getting stuck

• #14519 46428e7 Thanks @jsilvermist! - Fix backend startup when a Windows drive root is opened as a workspace.

• #14932 f852d17 - Show page cursor feedback in the Integrated Browser, including text fields, resize handles, and drag controls, without changing page scrolling or compositing.

• #14934 6e033dc - Use the standard open-in-browser icon for the Agent Manager PR panel's external link button, so it matches the open-in-browser affordance used elsewhere in the app.

• #14734 1ecce5a Thanks @brunoagatao! - Label scheduled cron and wakeup prompts in the chat instead of showing them as user messages

• #14901 2c25217 - Fix a thin line of diff content showing above the sticky file header in the Agent Manager diff panel and review when VS Code is zoomed.

• #14930 0988371 - Add a tooltip to the subagent open button in the chat transcript. It shows whether the subagent opens in an editor tab (sidebar) or in the Agent Manager panel.

• Updated dependencies [0a5c6df]:

  • @kilocode/kilo-indexing@7.8.9
  • @opencode-ai/core@7.8.9
  • @kilocode/kilo-ui@7.8.9
  • @opencode-ai/ui@7.8.9

CLI

7.8.12

Minor Changes

• #15030 d749650 - Route Kilo Gateway traffic (chat, models, embeddings, autocomplete, transcription) through https://ai-gateway.kilo.ai/api/v1 by default, and support a KILO_AI_GATEWAY_URL environment variable to override it. Setting only KILO_API_URL keeps routing gateway traffic through that server.

7.8.10

Minor Changes

• #14988 9a55ea4 Thanks @WebReflection! - Add an experimental Search Ignored Paths setting that lists ignored folders or files, such as build output, that the agent's glob tool should still search

• #15004 8f6c4e2 - Let the mobile app fork a session from a specific message onto a remote CLI: create_session accepts cloneUpToMessageId, imports only the transcript up to that message, and restores only the file edits made before it.

Patch Changes

• #15017 e48c978 Thanks @WebReflection! - Keep .gitignored files and folders, such as node_modules, out of glob results and grep include searches, even when the pattern matches folder names, like **/*

• #15056 0e6da31 - Fix grep failing with "Invalid ripgrep match output" when matched lines aren't valid UTF-8, such as in ISO-8859-1 / Windows-1252 encoded files

• #15047 fdb634f - Keep MCP sign-in from resetting

  Automatic OAuth recovery no longer clears stored credentials another session just refreshed, and signing in to a remote MCP server now updates the authentication warning in every open session instead of only the one that started it. The optional MCP stream probe is also restricted to its own endpoint so it cannot rewrite OAuth metadata or token responses.

• #14857 37f81b1 Thanks @mardausdennis! - Reduce CPU usage while Windows background jobs are running and improve stop handling when a job takes longer to finish.

• #14857 5e99e9c Thanks @mardausdennis! - Fix Windows background jobs staying active after their command finishes or treating unrelated programs as part of the job. If a job cannot be stopped safely, the stop request fails with an error and the job output says why.

7.8.9

Patch Changes

• #14528 6f90fe1 - Tune the agent_manager and task tool instructions so agents only start new Agent Manager sessions or worktrees when the user explicitly asks, or after confirming with the user first.

• #14524 adf5026 Thanks @kimnamu! - Keep Amazon Bedrock GPT-6 and GPT-5.6 sessions working after a tool returns an image.

• #14192 4290338 Thanks @maphew! - Cloud sessions: the bash tool now advertises a session-scoped temp dir covered by the injected permission rules instead of the denied shared temp dir.

• #14064 1ed91ed Thanks @cpruijsen! - Stop reporting a false frontmatter parse error when saving command markdown files

• #14537 b9e4b1e - Report an error instead of silently keeping the old value when a config change is overridden by a higher-priority file such as opencode.json. Config validation and write failures now return the file and issue details instead of an opaque server error.

• #14757 f01c7dd Thanks @thomasbrugman! - Avoid enabling thinking automatically for custom providers whose names contain zai or zhipuai.

• #14651 07848e1 Thanks @quanzhuo! - Report empty summaries and unrecoverable context overflow during compaction instead of silently stopping. Preserve conversation history and explain when to retry compaction or start a new session.

• #14838 a1fbca0 Thanks @jhapate0704! - Improve missing binary error message on Windows ARM64 to provide actionable workarounds (x64 emulation or WSL2).

• #14906 2dd87e7 - Expose a custom or plugin command named goal as /goal:command instead of dropping it. /goal still starts a session goal, and the configuration warning now names the alias so the command stays reachable.

• #14970 296b9de - Respect permission settings from global and project kilo.jsonc in the JetBrains plugin. Edits now follow your configured permission.edit value instead of being forced to ask, and the Auto-Approve settings page reflects the effective level.

• #13593 1f093ff Thanks @maphew! - Log structural diagnostics (message part sequences, tool-call/result pairing, schema issue paths) when the AI SDK rejects an assembled request, instead of failing with a bare ModelMessage[] schema error.

• #14809 3b0be76 Thanks @kr1shna-exe! - Stop MCP servers from piling up when a request is cancelled while they are still starting. Servers that had already started are now shut down, and the next request starts MCP again instead of failing until the backend restarts.

• #14812 b4b51f2 - Keep slash commands working when a plugin or your config defines a command named goal. Such a command clashes with Kilo's own /goal and used to hide every slash command, including /init, /review, and your own, leaving autocomplete empty. The clashing command is now skipped and reported as a configuration warning, so the CLI, VS Code, and JetBrains all tell you which command was ignored and why, while the rest keep working. A command list that fails to load also shows a warning in the CLI instead of silently showing no commands.

• #14830 e38a045 Thanks @abdulhusainahk! - Force kilo serve to exit after five seconds if graceful shutdown stalls, so editor shutdown cannot leave the backend running indefinitely.

• #14816 3ad45fd Thanks @kr1shna-exe! - Reduce the work done on every agent step in long sessions once the request passes the payload pruning limit. The session transcript is no longer reloaded and re-serialized after pruning, and pruning no longer reads the whole session history again. Plan mode also keeps its plan file instructions on those steps.

• #14776 225c393 - Fix SVG and other non-raster image attachments failing the whole prompt instead of being read as source. Fix a rejected or failed send losing the typed message with no way to recover it, and add a Dismiss action to standalone error cards that have no transcript tail to retry.

• #14037 4ed8e7b Thanks @maphew! - Task tool: a bare model name in subagent_model or an agent model now resolves to the matching provider model instead of failing with a "Model not found" error or being ignored. The parent session's provider is preferred when several providers offer a model with the same name.

• #13955 bb652c5 Thanks @rakshith1928! - Fix permission and question prompts disappearing when switching sessions in the TUI. Approval prompts for running subagents and sessions now persist across session switches and are restored when switching back, so sessions are never left blocked on an unanswered prompt.

• Updated dependencies [0a5c6df]:

  • @kilocode/kilo-indexing@7.8.9
  • @opencode-ai/server@7.8.9
  • @opencode-ai/tui@7.8.9
  • @opencode-ai/ui@7.8.9

Added

• Show and edit agent models from the agents list.
• Configure transcript display, with a live preview and localized settings.
• Reuse the Core submenu in the prompt bar menu.
• Opt in to the Marketplace error handler.
• Fork a remote session from a message in the CLI.
• Let glob search an opt-in allowlist of ignored paths.
• Bundle Kilo CLI v7.8.12.

Fixed

• Restore session lists after a CLI reconnect.
• Stop overriding the user permission config.
• Clear MCP sign-in state when the server is removed.
• Make the model reset forget the saved per-mode pick.
• Navigate to transcript parts from the session timeline, and jump to a step when its timeline bar is clicked.
• Auto-expand transcript blocks only while live.
• Recover a missed pending prompt from backend activity.
• Surface unreadable attachments as an inline chat notice.
• Use the primary brand yellow for logos.
• Keep RC builds on the production session database.
• Report why a provider failed to load instead of hiding it.
• Preserve custom agents and edit permissions during delegation.
• Stop automatic MCP OAuth reset and sync auth badges.
• Handle non-UTF-8 ripgrep matches in grep.
• Stop glob and grep include patterns from bypassing .gitignore.
• Track Windows background jobs and runner identity natively, and reject stale parent links when stopping them.
• Require explicit user intent before starting Agent Manager sessions or worktrees.
• Expose a reserved command-name clash as /goal:command.
• Point cloud sessions at a permitted temp directory.
• Resolve bare model names for task subagents.
• Surface terminal compaction failures.
• Limit Z.ai thinking defaults to built-in providers.
• Avoid false frontmatter errors when saving command files.
• Bound serve shutdown after signals.
• Send tool-result images as user content for Bedrock GPT-6 models.
• Reuse the loaded transcript when pruning large payloads.
• Clean up MCP servers when their startup is interrupted.
• Improve the missing-binary error message for Windows ARM64.
• Retry retryable connection resets through the normal backoff path.
• Start the backend in Windows drive-root workspaces.

Changed

• Route gateway traffic via KILO_AI_GATEWAY_URL.

VS Code

Minor Changes

• #14988 9a55ea4 Thanks @WebReflection! - Add an experimental Search Ignored Paths setting that lists ignored folders or files, such as build output, that the agent's glob tool should still search

Patch Changes

• #15017 e48c978 Thanks @WebReflection! - Keep .gitignored files and folders, such as node_modules, out of glob results and grep include searches, even when the pattern matches folder names, like **/*

• #15056 0e6da31 - Fix grep failing with "Invalid ripgrep match output" when matched lines aren't valid UTF-8, such as in ISO-8859-1 / Windows-1252 encoded files

CLI

Minor Changes

• #14988 9a55ea4 Thanks @WebReflection! - Add an experimental Search Ignored Paths setting that lists ignored folders or files, such as build output, that the agent's glob tool should still search

• #15004 8f6c4e2 - Let the mobile app fork a session from a specific message onto a remote CLI: create_session accepts cloneUpToMessageId, imports only the transcript up to that message, and restores only the file edits made before it.

Patch Changes

• #15017 e48c978 Thanks @WebReflection! - Keep .gitignored files and folders, such as node_modules, out of glob results and grep include searches, even when the pattern matches folder names, like **/*

• #15056 0e6da31 - Fix grep failing with "Invalid ripgrep match output" when matched lines aren't valid UTF-8, such as in ISO-8859-1 / Windows-1252 encoded files

• #15047 fdb634f - Keep MCP sign-in from resetting

  Automatic OAuth recovery no longer clears stored credentials another session just refreshed, and signing in to a remote MCP server now updates the authentication warning in every open session instead of only the one that started it. The optional MCP stream probe is also restricted to its own endpoint so it cannot rewrite OAuth metadata or token responses.

• #14857 37f81b1 Thanks @mardausdennis! - Reduce CPU usage while Windows background jobs are running and improve stop handling when a job takes longer to finish.

• #14857 5e99e9c Thanks @mardausdennis! - Fix Windows background jobs staying active after their command finishes or treating unrelated programs as part of the job. If a job cannot be stopped safely, the stop request fails with an error and the job output says why.