Changelog — July 13, 2026

Kilo Code shipped v7.4.7, the stable release that promotes the v7.4.6 pre-release plus one follow-up patch, on top of v7.4.5. The user-facing additions:

• In-chat search (#12155): click the search icon in the session header to find text across the current conversation — with match-case, whole-word, and regular-expression options — then step through highlighted matches with next/previous controls. Works in both the sidebar and editor-tab chats.
• Multiple same-repo sessions as tabs (#10466): open several sessions for the same repository as tabs from the Kilo sidebar and editor-tab chats, so parallel lines of work no longer overwrite one shared session.
• Configurable network allowlist for sandboxed tools (#12075): specify network destinations that sandboxed tools are allowed to reach while network access is otherwise restricted — a middle ground between fully open and fully blocked egress.
• Browse-files in the @ mention dropdown (#12028): a new "Browse files…" option opens a native file picker so you can mention a file by navigating to it, instead of only typing a path.
• Focus fix (v7.4.7 patch, #12176): closing an active session tab now returns focus to the sidebar prompt so you can keep typing without reaching for the mouse.

Who should care: Kilo Code VS Code extension users. In-chat search and multi-session tabs are day-to-day workflow wins; the network-destination allowlist is the security-relevant one — it lets teams that sandbox tool execution grant just the endpoints a task needs (package registries, an internal API) without opening egress wholesale.

Kilo Code v7.4.7 release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/security/, /kilocode/orchestrator/

v0.0.81 is now tagged (release notes #6712), summarizing what landed on main since v0.0.80. The changes that matter to users:

• Native OpenShell GPU injection is now preferred (#6333): on eligible Linux Docker hosts, automatic GPU onboarding prefers native OpenShell CDI injection and retries exactly once through the older compatibility path — only after trusted failure classification and proven-safe cleanup. It's non-breaking: the existing CLI, environment controls, and registry behavior are preserved. Validation on DGX Spark (aarch64) and DGX Station GB300 hardware is still pending, so that issue stays open.
• Blueprint apply now fails closed on setup errors (#6703/#6704): the direct Blueprint runner's actionApply previously ran the required openshell provider create and openshell inference set mutations without checking their exit codes — so a failure was silently ignored, plan.json was still persisted, and the run reported Apply complete for a sandbox that could not actually perform inference. Apply now fails when either mutation errors.
• Managed Deep Code sessions are reaped on completion (#6721): headless Deep Agents Code sessions now run through the existing session supervisor, so completion cleans up their DCode and LangGraph descendants instead of leaving a retained process tree. The interactive abrupt-relay disconnect case remains open — against pinned OpenShell 0.0.72, the gateway retains the server-side relay after the client disconnects, so the in-sandbox supervisor never receives a HUP.
• Node.js minimum raised to 22.19 (#6729): up from 22.16, to match the current OpenClaw runtime and advisor SDK requirements (engines, installer/developer checks, CI, and the user-facing prerequisites all move together). Check your host Node version before upgrading.
• Also: backup-all now clearly explains when a sandbox is skipped because it isn't running and how to remediate (start the sandbox/container and rerun) rather than silently skipping (#6673); and Hermes rebuilds now preserve the .hermes/dashboard-home/ profile — Dashboard MEMORY.md and USER.md — with the manual backup/restore examples updated to carry those two files without copying the secret-bearing dashboard .env (#6712).
• Landing on main since the tag (queued for v0.0.82): backup-all goes a step further — an eligible stopped Docker sandbox is now backed up by briefly starting it, capturing the normal snapshot, and returning it to the stopped state, turning the earlier "0 backed up, 1 skipped" exit-1 case into a clean backup; it still fails closed unless exactly one labelled container safely resolves to the registered owner (#6723). Separately, the dangerous-host / catch-all-egress policy checks now also apply to runtime custom policies loaded via policy add --from-file and in-memory presets, closing a gap where such hosts were rejected in repository validation but could still slip in at runtime (#6731); and nemoclaw onboard now fails fast on a gateway-port conflict — a foreign process already listening on the OpenShell gateway port is reported with PID/process details and remediation (including NEMOCLAW_GATEWAY_PORT) instead of silently stalling onboarding (#6759). OpenShell stays pinned at 0.0.72, though the installer now trusts v0.0.82 release manifests in preparation for a future bump (#6778).

Who should care: NemoClaw users on GPU Linux Docker hosts (the native-injection path is now the default route), anyone automating Blueprint apply in CI (a "success" now genuinely means the sandbox can run inference), and self-hosters on older Node — 22.19 is the new floor. These are commit-level changes on main; v0.0.81 is the release label NVIDIA has attached to them.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/policy/, /nemoclaw/skills/