From 26f573d441e2e7ecbe9a1e279ae8591dca64f8ca Mon Sep 17 00:00:00 2001
From: marius-kilocode <marius@kilocode.ai>
Date: Fri, 10 Jul 2026 18:20:29 +0200
Subject: [PATCH] fix(vscode): preserve seccomp license resources

---
 .../src/services/cli-backend/cli-resources.ts | 18 ++++++------
 .../tests/unit/server-manager-utils.test.ts   | 29 +++++++++++++++++++
 2 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/packages/kilo-vscode/src/services/cli-backend/cli-resources.ts b/packages/kilo-vscode/src/services/cli-backend/cli-resources.ts
index c23f56b5d89..5caf3b1387b 100644
--- a/packages/kilo-vscode/src/services/cli-backend/cli-resources.ts
+++ b/packages/kilo-vscode/src/services/cli-backend/cli-resources.ts
@@ -65,15 +65,6 @@ export async function copySandboxResources(source: string, target: string): Prom
   await Promise.all(sandboxNetworkFiles.map((file) => fs.promises.rm(path.join(to, file), { force: true })))
   await fs.promises.rm(path.join(to, sandboxRuntimeLicense), { recursive: true, force: true })
 
-  const executable = path.join(from, bwrap)
-  if (!fs.existsSync(executable)) return
-  await fs.promises.copyFile(executable, helper)
-  await fs.promises.chmod(helper, 0o755)
-
-  const licenses = path.join(from, bwrapLicense)
-  if (!fs.existsSync(licenses)) return
-  await fs.promises.cp(licenses, destination, { recursive: true })
-
   for (const file of sandboxNetworkFiles) {
     const input = path.join(from, file)
     if (!fs.existsSync(input)) continue
@@ -85,6 +76,15 @@ export async function copySandboxResources(source: string, target: string): Prom
   if (fs.existsSync(runtimeLicense)) {
     await fs.promises.cp(runtimeLicense, path.join(to, sandboxRuntimeLicense), { recursive: true })
   }
+
+  const executable = path.join(from, bwrap)
+  if (!fs.existsSync(executable)) return
+  await fs.promises.copyFile(executable, helper)
+  await fs.promises.chmod(helper, 0o755)
+
+  const licenses = path.join(from, bwrapLicense)
+  if (!fs.existsSync(licenses)) return
+  await fs.promises.cp(licenses, destination, { recursive: true })
 }
 
 export async function copyKiloSandboxWorker(source: string, target: string): Promise<void> {
diff --git a/packages/kilo-vscode/tests/unit/server-manager-utils.test.ts b/packages/kilo-vscode/tests/unit/server-manager-utils.test.ts
index 1dbb25bcd66..db9ac71a419 100644
--- a/packages/kilo-vscode/tests/unit/server-manager-utils.test.ts
+++ b/packages/kilo-vscode/tests/unit/server-manager-utils.test.ts
@@ -175,6 +175,35 @@ describe("cli tree-sitter resources", () => {
     }
   })
 
+  it("copies seccomp licensing when bundled Bubblewrap is omitted", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "kilo-vscode-seccomp-license-"))
+    try {
+      const source = path.join(root, "dist", "bin", "kilo")
+      const target = path.join(root, "extension", "bin", "kilo")
+      const relay = path.join(path.dirname(source), "kilo-sandbox-network-relay.js")
+      const seccomp = path.join(path.dirname(source), "kilo-sandbox-seccomp")
+      const license = path.join(path.dirname(source), "licenses", "sandbox-runtime", "LICENSE")
+
+      await fs.mkdir(path.dirname(license), { recursive: true })
+      await fs.mkdir(path.dirname(target), { recursive: true })
+      await fs.writeFile(source, "binary")
+      await fs.writeFile(target, "binary")
+      await fs.writeFile(relay, "relay")
+      await fs.writeFile(seccomp, "seccomp")
+      await fs.writeFile(license, "Apache-2.0")
+
+      await copySandboxResources(source, target)
+
+      expect(await fs.readFile(path.join(path.dirname(target), "kilo-sandbox-network-relay.js"), "utf8")).toBe("relay")
+      expect(await fs.readFile(path.join(path.dirname(target), "kilo-sandbox-seccomp"), "utf8")).toBe("seccomp")
+      expect(await fs.readFile(path.join(path.dirname(target), "licenses", "sandbox-runtime", "LICENSE"), "utf8")).toBe(
+        "Apache-2.0",
+      )
+    } finally {
+      await fs.rm(root, { recursive: true, force: true })
+    }
+  })
+
   it("removes stale sandbox resources when the source has none", async () => {
     const root = await fs.mkdtemp(path.join(os.tmpdir(), "kilo-vscode-sandbox-stale-"))
     try {