Fetching from the wire…
Public story · 2026-09-18 · high
The same release also fixes a sandbox prompt that misstated what approving a command grants.
Why now: Kilocode published v7.7.4 on September 18, pairing the MCP context-bloat fix with the corrected sandbox-approval wording in one release.
Kilocode's coding agent can now write JavaScript that calls MCP tools directly, per the v7.7.4 release notes, published September 18.
Connecting 40 MCP servers to Kilocode can fill a model's context window with tool definitions before a user sends a single message. Kilocode's fix, called code mode, discovers tools on demand instead of loading every definition upfront, so fewer of them reach the model at all.
The feature runs inside a confined JS program and stays off unless a user turns it on, either through a setting or the KILO_EXPERIMENTAL_CODE_MODE environment variable.
The same release also stops prompting for sandbox escape on read-only git and gh commands.
It rewrites the escalation prompt too. The old wording implied a narrower grant than users were giving. The new text says plainly that approving a command runs it entirely outside the sandbox, for that command only, and that Bash allow rules never cover it.
Each link below shares sources, entities, or timing with this story.
Two merged PRs, five hours apart, and together they change what agent tool approval means on macOS. PR #43624, merged at 00:15Z on September 8, implements macOS user verification using P-256 keys in the Secure Enclave, stored in the Data Protection Keychain, with biometric aut...
Waishnav/devspace (4,247 stars, v1.0.8 August 25) runs a local Node server exposing read, edit, search and shell execution over MCP, reached through a reverse proxy tunnel like Cloudflare or ngrok, with password-gated owner approval per client. The pitch is turning ChatGPT int...
v0.14.0 landed July 28 and model/tool data is no longer logged unless you explicitly opt in. It also brings Programmatic Tool Calling to JS (the model generates hosted JavaScript that coordinates tools and reduces intermediate results, preserved across streaming, sessions, and...
One Claude Code release fixed two independent permission-check bypasses on the same day. That's the story. Version 2.1.221, shipped August 4, patches a Bash tool bypass where zsh could execute hidden commands embedded inside [[ ]] regex conditionals. The approval prompt never...
The most under-hyped tool of the week is a single Rust binary with zero dependencies that sits between your coding agent and your terminal, compressing command outputs before they hit the context window. rtk (Rust Token Killer) intercepts common dev commands — cargo test, git...
The release carries three security fixes mid-list: Bash commands looping over or assigning certain special shell variables now ask permission instead of running unprompted, worktree-isolated sessions refuse Bash commands with certain nested shell expansions, and MCP connection...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.