Agent Breaking Changes_

← Kilo Code

Kilo Code v7.8.18 (release)

2026-10-26 · official notes

Summary

• Patch Changes
• #15472 9d28e36 - Fix copying selected chat text with Cmd/Ctrl+C or right-click Copy in VS Code 1.143. The selection no longer clears and focus no longer jumps to the prompt.
• #15410 5f2aa0b Thanks @WebReflection! - Update DOMPurify to 3.4.17 to fix sanitization issues flagged by Dependabot alerts.

Full notes

## VS Code

### 7.8.18

#### Patch Changes

- [#15472](https://github.com/Kilo-Org/kilocode/pull/15472) [`9d28e36`](https://github.com/Kilo-Org/kilocode/commit/9d28e36c7734e00a686f7d41e467934134c7f07f) - Fix copying selected chat text with Cmd/Ctrl+C or right-click Copy in VS Code 1.143. The selection no longer clears and focus no longer jumps to the prompt.

- [#15410](https://github.com/Kilo-Org/kilocode/pull/15410) [`5f2aa0b`](https://github.com/Kilo-Org/kilocode/commit/5f2aa0b32fa4fafe1c544ac4a5203fc913e36225) Thanks [@WebReflection](https://github.com/WebReflection)! - Update DOMPurify to 3.4.17 to fix sanitization issues flagged by Dependabot alerts.

- [#15412](https://github.com/Kilo-Org/kilocode/pull/15412) [`0377248`](https://github.com/Kilo-Org/kilocode/commit/0377248fb9af4ba12d04521821372a4d95cb1f6a) Thanks [@WebReflection](https://github.com/WebReflection)! - Update vite to 7.3.7 to fix the launch-editor editor CLI flag misinterpretation flagged by Dependabot (CVE-2026-112944).

## CLI

### 7.8.18

#### Minor Changes

- [#15358](https://github.com/Kilo-Org/kilocode/pull/15358) [`f96361f`](https://github.com/Kilo-Org/kilocode/commit/f96361fe1470239a30be2633940160fc38c9030a) - Expose hosted cloud sessions through the local Kilo API, so editors can discover, read, and interact with a hosted session without ever handling its provider credentials.

#### Patch Changes

- [#15430](https://github.com/Kilo-Org/kilocode/pull/15430) [`ef2f6d9`](https://github.com/Kilo-Org/kilocode/commit/ef2f6d9c7a30b1fc1791bf71f40803aa0ff96975) Thanks [@WebReflection](https://github.com/WebReflection)! - Update the MCP TypeScript SDK to 1.32.1 to fix security issues flagged by Dependabot, including MCP HTTP and OAuth requests following cross-origin redirects. Remote MCP servers whose URL redirects to another origin, or answers `POST` with a `301`, `302` or `303` redirect, no longer connect; use the server's final URL instead.