fix(vscode): stop duplicate permission prompts (#408)

[Githubguy132010]

Fixes #408

Context

Fixes duplicate/stacked permission prompts in the VS Code webview (#408).

The UI was showing the same permission request in two places at once:

• The message-stream tool permission UI (from @kilocode/kilo-ui Message rendering)
• A second custom permission dock rendered in ChatView

It could also accumulate duplicate permission entries when the same permission event was delivered more than once.

Implementation

• Removed the custom permission dock from ChatView so permission actions render in a single place.
• Scoped DataBridge permissions by current sessionID before passing to DataProvider.
• Added permission queue helpers and used them in session context:
  • upsertPermission (replace by id, no duplicates)
  • removeSessionPermissions (cleanup on session delete)
• Added unit tests for permission queue behavior:
  • append new permission
  • update existing permission without duplication
  • preserve other entries
  • remove deleted-session permissions only

Screenshots

before	after
Duplicate permission action boxes stacked in session UI (issue screenshot)	Single permission action box with normal tool items still visible

How to Test

1. Install this branch's VSIX or run the extension from source.
2. Open Kilo sidebar, start a new task.
3. Run a prompt that triggers multiple permission requests quickly, for example:
   • Read /etc/hosts
   • Create /tmp/kilo-permission-test/a.txt
   • Create /tmp/kilo-permission-test/b.txt
   • Read both files back
4. Verify:
   • Only one permission action UI is shown per request (no stacked duplicates).
   • Non-permission tool cards still render normally.
   • Allow/deny resolves the prompt and flow continues.

Get in Touch

thomas07374

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[Copilot]

Pull request overview

This PR fixes duplicate permission prompts in the VS Code webview (#408) by removing redundant UI rendering and implementing proper permission queue management with deduplication.

Changes:

• Added permission-queue.ts helper functions with upsertPermission and removeSessionPermissions to prevent duplicate permission entries
• Integrated permission queue helpers into session context for proper state management
• Removed the custom permission dock from ChatView to eliminate duplicate rendering (permissions are now rendered only by kilo-ui's Message component)
• Scoped permissions by sessionID in DataBridge to ensure only current session permissions are passed to UI components

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/kilo-vscode/webview-ui/src/context/permission-queue.ts	New helper functions for permission queue management with upsert and session-based cleanup logic
packages/kilo-vscode/webview-ui/src/context/session.tsx	Integrated permission queue helpers: upsertPermission in handlePermissionRequest and removeSessionPermissions in session deletion
packages/kilo-vscode/webview-ui/src/components/chat/ChatView.tsx	Removed duplicate custom permission dock UI, keeping only the kilo-ui Message component rendering
packages/kilo-vscode/webview-ui/src/App.tsx	Scoped permissions by current sessionID in DataBridge before passing to DataProvider
packages/kilo-vscode/tests/unit/permission-queue.test.ts	Comprehensive unit tests for permission queue helpers covering append, update, and removal scenarios

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[iscekic]

Thank you for the contribution! Looks good to me. The bot found this - seems safe to do:

Removing the ChatView permission dock entirely introduces a regression for permissions that don't have a tool field. The ToolPartDisplay in message-part.tsx:542 guards with if (!next || !next.tool) return undefined, so permissions without tool will have no UI rendered anywhere, while blocked() still hides PromptInput — deadlocking the user.

This happens today with doom-loop detection (processor.ts:157), which calls PermissionNext.ask() without setting tool.

Instead of removing the permission dock entirely, gate it so it only renders for permissions that lack tool:

<Show when={permissionRequest()} keyed>
  {(perm) => (
    <Show when={!perm.tool}>
      {/* existing permission dock JSX, unchanged */}
    </Show>
  )}
</Show>

Permissions with tool render inline via ToolPartDisplay (no duplicates — your fix). Permissions without tool (doom-loop, or any future permission type) still have a fallback UI. You'd just need to keep the decide function, responding signal, useLanguage import, and the dock JSX from dev — and wrap it in the extra <Show when={!perm.tool}>.

[vercel]

@iscekic is attempting to deploy a commit to the Kilo Code Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kilo-ui-storybook	Ready	Preview, Comment	Feb 19, 2026 10:52am

[markijbema]

I don't think packages/app should be changed, as that isnt used and/or shouldnt be used

[kiloconnect]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (5 files)

• packages/kilo-vscode/tests/unit/permission-queue.test.ts - New test file with good coverage of upsert and removal helpers
• packages/kilo-vscode/webview-ui/src/App.tsx - DataBridge scoped to current session; permissions filtered by sessionID
• packages/kilo-vscode/webview-ui/src/components/chat/ChatView.tsx - Permission dock now only shows non-tool permissions (tool permissions render inline)
• packages/kilo-vscode/webview-ui/src/context/permission-queue.ts - Clean utility functions for upsert and session cleanup
• packages/kilo-vscode/webview-ui/src/context/session.tsx - Uses new permission queue helpers for dedup and cleanup