es697 · darkogj · Jun 17, 2026 · Jun 17, 2026 · Jun 17, 2026 · Jun 17, 2026
diff --git a/.changeset/background-process-ports.md b/.changeset/background-process-ports.md
diff --git a/.changeset/background-processes-cli.md b/.changeset/background-processes-cli.md
diff --git a/.changeset/bright-windows-logo.md b/.changeset/bright-windows-logo.md
diff --git a/.changeset/calm-powershell-alerts.md b/.changeset/calm-powershell-alerts.md
@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": patch
+"kilo-code": patch
+---
+
+Run Windows PowerShell tool commands without `-EncodedCommand` to reduce antivirus false positives.
diff --git a/.changeset/chat-fim-fallback.md b/.changeset/chat-fim-fallback.md
@@ -0,0 +1,6 @@
+---
+"kilo-code": patch
+"@kilocode/kilo-gateway": patch
+---
+
+Use the matching FIM model for chat autocomplete when Next Edit is selected.
diff --git a/.changeset/create-plan-dir.md b/.changeset/create-plan-dir.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Create the default `.kilo/plans` directory automatically when Plan mode starts.
diff --git a/.changeset/custom-question-jetbrains.md b/.changeset/custom-question-jetbrains.md
diff --git a/.changeset/fix-command-template-serialization.md b/.changeset/fix-command-template-serialization.md
diff --git a/.changeset/jetbrains-clickable-prompt-mentions.md b/.changeset/jetbrains-clickable-prompt-mentions.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Highlight rendered prompt file mentions and open them on click.
diff --git a/.changeset/jetbrains-empty-mention-completion.md b/.changeset/jetbrains-empty-mention-completion.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Show JetBrains file mention suggestions immediately for empty `@` mentions and keep the completion popup stable while typing quickly.
diff --git a/.changeset/jetbrains-file-mention-parity.md b/.changeset/jetbrains-file-mention-parity.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Hide raw file contents from mentioned files in JetBrains chat messages.
diff --git a/.changeset/jetbrains-git-changes-data-url.md b/.changeset/jetbrains-git-changes-data-url.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Fix @git-changes mentions causing JetBrains chat sessions to fail.
diff --git a/.changeset/jetbrains-logged-out-account-panel.md b/.changeset/jetbrains-logged-out-account-panel.md
diff --git a/.changeset/jetbrains-login-dismiss.md b/.changeset/jetbrains-login-dismiss.md
diff --git a/.changeset/jetbrains-login-qr.md b/.changeset/jetbrains-login-qr.md
diff --git a/.changeset/jetbrains-mention-icons-priority.md b/.changeset/jetbrains-mention-icons-priority.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Show file type icons and keep predefined mentions first in JetBrains mention completions.
diff --git a/.changeset/jetbrains-paid-model-login.md b/.changeset/jetbrains-paid-model-login.md
diff --git a/.changeset/jetbrains-permission-compact-rows.md b/.changeset/jetbrains-permission-compact-rows.md
diff --git a/.changeset/jetbrains-profile-polish.md b/.changeset/jetbrains-profile-polish.md
diff --git a/.changeset/jetbrains-profile-settings.md b/.changeset/jetbrains-profile-settings.md
diff --git a/.changeset/jetbrains-prompt-completion.md b/.changeset/jetbrains-prompt-completion.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": minor
+---
+
+Add `/` slash commands and `@` file/git-changes mentions to the JetBrains chat prompt with native completion.
diff --git a/.changeset/jetbrains-prompt-hint.md b/.changeset/jetbrains-prompt-hint.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Show a concise single-line hint in the JetBrains prompt placeholder.
diff --git a/.changeset/jetbrains-prompt-mentions-undo.md b/.changeset/jetbrains-prompt-mentions-undo.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Fix prompt undo/redo, clean mid-token mention completion, and show unresolved file mentions in the JetBrains chat prompt.
diff --git a/.changeset/jetbrains-send-typed-mentions.md b/.changeset/jetbrains-send-typed-mentions.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Attach hand-typed prompt file mentions when sending immediately.
diff --git a/.changeset/jetbrains-session-account-overlay.md b/.changeset/jetbrains-session-account-overlay.md
diff --git a/.changeset/jetbrains-session-focus-restore.md b/.changeset/jetbrains-session-focus-restore.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Restore prompt focus after returning from session history in JetBrains.
diff --git a/.changeset/jetbrains-slash-aliases.md b/.changeset/jetbrains-slash-aliases.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Support VS Code slash-command aliases in the JetBrains prompt.
diff --git a/.changeset/jetbrains-stable-mention-completion.md b/.changeset/jetbrains-stable-mention-completion.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/kilo-jetbrains": patch
+---
+
+Keep JetBrains prompt mention suggestions stable while typing fuzzy file matches.
diff --git a/.changeset/local-review-static-template.md b/.changeset/local-review-static-template.md
diff --git a/.changeset/mingw-terminal-keyboard.md b/.changeset/mingw-terminal-keyboard.md
diff --git a/.changeset/persist-index-updates.md b/.changeset/persist-index-updates.md
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Preserve unchanged codebase indexes when extension or VS Code updates interrupt an incremental scan.
diff --git a/.changeset/quiet-auto-approved-permissions.md b/.changeset/quiet-auto-approved-permissions.md
@@ -0,0 +1,5 @@
+---
+"kilo-code": patch
+---
+
+Keep attention sounds silent for permission requests handled by auto-approve.
diff --git a/.changeset/sandbox-agent-writes.md b/.changeset/sandbox-agent-writes.md
@@ -0,0 +1,6 @@
+---
+"@kilocode/cli": minor
+"kilo-code": minor
+---
+
+Confine agent shell and file-tool writes to project and Kilo state directories with the optional macOS sandbox.
diff --git a/.changeset/secure-worktree-sandboxes.md b/.changeset/secure-worktree-sandboxes.md
@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": patch
+---
+
+Confine sandboxed worktree sessions to their active worktree instead of allowing writes to sibling or primary checkouts.
diff --git a/.changeset/session-expandable-defaults.md b/.changeset/session-expandable-defaults.md
diff --git a/.changeset/session-question-view-style.md b/.changeset/session-question-view-style.md
diff --git a/.changeset/tidy-indexing-button.md b/.changeset/tidy-indexing-button.md
@@ -0,0 +1,5 @@
+---
+"kilo-code": minor
+---
+
+Let users hide the codebase indexing button while indexing is off.
diff --git a/.changeset/xai-grok-oauth.md b/.changeset/xai-grok-oauth.md
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,12 @@
+.git
+.opencode
+.sst
+.turbo
+.wrangler
+node_modules
+**/node_modules
+**/.output
+**/dist
+**/.turbo
+**/.vite
+**/coverage
diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
@@ -23,7 +23,7 @@ runs:
         fi
 
     - name: Setup Bun
-      uses: oven-sh/setup-bun@v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
         bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
         bun-download-url: ${{ steps.bun-url.outputs.url }}
@@ -33,8 +33,9 @@ runs:
       shell: bash
       run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
 
-    - name: Cache Bun dependencies
-      uses: actions/cache@v4
+    - name: Restore Bun dependencies
+      id: bun-cache
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ steps.cache.outputs.dir }}
         key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
@@ -56,3 +57,10 @@ runs:
           bun install ${{ inputs.install-flags }}
         fi
       shell: bash
+
+    - name: Save Bun dependencies
+      if: steps.bun-cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.cache.outputs.dir }}
+        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
diff --git a/.github/actions/setup-git-committer/action.yml b/.github/actions/setup-git-committer/action.yml
@@ -21,7 +21,7 @@ runs:
   steps:
     - name: Create app token
       id: apptoken
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
       with:
         # kilocode_change start
         app-id: ${{ inputs['kilo-maintainer-app-id'] }}

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
@@ -0,0 +1,12 @@
+# kilocode_change - new file
+name: Critical-only CodeQL config
+
+query-filters:
+  - include:
+      kind:
+        - problem
+        - path-problem
+        - alert
+        - path-alert
+      tags contain: security
+      security-severity: /^(9(\.[0-9])?|10(\.0)?)$/
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -1,3 +1,9 @@
+## Issue
+
+<!-- Reference an existing issue with `Fixes #123`, `Closes #123`, or equivalent linked issue wording. -->
+
+Fixes #
+
 ## Context
 
 <!-- Brief description of WHAT you’re doing and WHY. -->
@@ -6,30 +12,63 @@
 
 <!--
 
-Some description of HOW you achieved it. Perhaps give a high level description of the program flow. Did you need to refactor something? What tradeoffs did you take? Are there things in here which you’d particularly like people to pay close attention to?
+Some description of HOW you achieved it. Perhaps give a high level description of the program flow. Did you need to refactor something? What tradeoffs did you take? Are there things in here which you’d particularly like people to pay close attention to? Keep this focused on context reviewers cannot infer from the diff; skip file-by-file summaries, placeholders, and other filler.
 
 -->
 
-## Screenshots
+## Screenshots / Video
+
+<!-- Required for visual changes. Include the relevant before/after or resulting state. -->
 
 | before | after |
 |---|---|
 |  |  |
 
 ## How to Test
 
+### Manual/local verification
+
+<!--
+Describe local CLI, extension, or docs verification. Example:
+- Opened the updated settings page and confirmed the new copy appears
+-->
+
+-
+
+### Reviewer test steps
+
 <!--
+Provide steps reviewers can retrace. Example:
+1. Sign in with a user with tracks
+2. Activate `show_awesome_cat_gifs` feature by adding `?feature.show_awesome_cat_gifs=1` to your URL
+3. Confirm you see a GIF with cats dancing
+-->
+
+-
 
-A straightforward scenario of how to test your changes will help reviewers that are not familiar with the part of the code that you are changing but want to see it in action. This section can include a description or step-by-step instructions of how to get to the state of v2 that your change affects.
+### Blocked checks and substitute verification
 
-A "How To Test" section can look something like this:
+<!--
+If a relevant command could not be completed, name the command, explain the blocker or failure, and describe the substitute verification performed. Example:
+- `bun run test:integration` could not complete because the required API key is unavailable; substitute verification was testing the affected flow manually in the development extension
+-->
 
-- Sign in with a user with tracks
-- Activate `show_awesome_cat_gifs` feature (add `?feature.show_awesome_cat_gifs=1` to your URL)
-- You should see a GIF with cats dancing
+-
 
+<!--
+Every PR marked ready for review must include testing evidence. A bare "Not tested" or "N/A" answer is not sufficient. For each piece of evidence make clear if the test was executed by the agent or by a human
+
+Docs-only, config-only, and similar changes still need concrete evidence. For examples, see [Testing Evidence for Pull Requests](https://kilo.ai/docs/contributing/development-environment#testing-evidence-for-pull-requests). Draft PRs may be incomplete until marked ready for review.
 -->
 
+## Checklist
+
+- [ ] Issue linked above, or exception explained
+- [ ] Tests/verification described
+- [ ] Screenshots/video included for visual changes, or marked N/A
+- [ ] Changeset considered for user-facing changes
+- [ ] I personally reviewed the diff and can explain the changes, including any AI-assisted work.
+
 ## Get in Touch
 
 <!-- We'd love to have a way to chat with you about your changes if necessary. If you're in the [Kilo Code Discord](https://kilo.ai/discord), please share your handle here. -->
diff --git a/.github/workflows/check-opencode-annotations.yml b/.github/workflows/check-opencode-annotations.yml
@@ -38,6 +38,9 @@ jobs:
           fi
 
       # kilocode_change start
+      - name: Check Effect Promise facade allowlist
+        run: bun run script/check-opencode-promise-facades.ts
+
       - name: Check workflow allowlist
         run: bun run script/check-workflows.ts
       # kilocode_change end