From b3050cbffdd8d6948f8ece35e778bd015320366b Mon Sep 17 00:00:00 2001
From: marius-kilocode <marius@kilocode.ai>
Date: Mon, 22 Jun 2026 17:06:51 +0200
Subject: [PATCH] feat(cli): add macOS file-level sandbox for agent tools

Add an OS-level sandbox that confines agent writes to the project and Kilo
state directories. Currently macOS-only (via sandbox-exec/seatbelt), with
Linux, Windows, network isolation, and worktree isolation deferred to
follow-up issues (#11538, #11540, #11542, #11544, #11546, #11547).

Two enforcement layers:
- Bash tool: kernel-level seatbelt confinement via sandbox-exec
- File tools (write/edit/apply_patch): TS-level AppFileSystem layer wrapper

Both share the same configurable scope, which respects existing permission
config (external_directory allows, project sandboxes).

Opt-in via experimental.sandbox config toggle or the lock button in the
prompt input.
---
 .../src/components/chat/PromptInput.tsx       |  31 +++-
 .../components/settings/ExperimentalTab.tsx   |  15 +-
 .../kilo-vscode/webview-ui/src/i18n/en.ts     |   7 +
 .../webview-ui/src/styles/prompt-input.css    |  24 +++
 .../webview-ui/src/types/messages/config.ts   |   1 +
 packages/opencode/src/config/config.ts        |   5 +
 packages/opencode/src/effect/app-runtime.ts   |   7 +-
 .../opencode/src/kilocode/sandbox/fs-layer.ts |  93 ++++++++++++
 .../opencode/src/kilocode/sandbox/guard.ts    |  78 ++++++++++
 .../opencode/src/kilocode/sandbox/index.ts    |   6 +
 .../opencode/src/kilocode/sandbox/scope.ts    |  81 ++++++++++
 .../src/kilocode/sandbox/seatbelt-base.ts     | 114 ++++++++++++++
 .../opencode/src/kilocode/sandbox/seatbelt.ts |  84 +++++++++++
 .../opencode/src/kilocode/sandbox/spawn.ts    |  17 +++
 packages/opencode/src/tool/shell.ts           |  49 +++++-
 .../test/kilocode/sandbox/seatbelt.test.ts    | 139 ++++++++++++++++++
 packages/sdk/js/src/v2/gen/types.gen.ts       |   1 +
 packages/ui/src/components/icon.tsx           |   1 +
 18 files changed, 749 insertions(+), 4 deletions(-)
 create mode 100644 packages/opencode/src/kilocode/sandbox/fs-layer.ts
 create mode 100644 packages/opencode/src/kilocode/sandbox/guard.ts
 create mode 100644 packages/opencode/src/kilocode/sandbox/index.ts
 create mode 100644 packages/opencode/src/kilocode/sandbox/scope.ts
 create mode 100644 packages/opencode/src/kilocode/sandbox/seatbelt-base.ts
 create mode 100644 packages/opencode/src/kilocode/sandbox/seatbelt.ts
 create mode 100644 packages/opencode/src/kilocode/sandbox/spawn.ts
 create mode 100644 packages/opencode/test/kilocode/sandbox/seatbelt.test.ts

diff --git a/packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx b/packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx
index 71b87c08ce..f9585b3d8a 100644
--- a/packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx
+++ b/packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx
@@ -78,7 +78,7 @@ export const PromptInput: Component<PromptInputProps> = (props) => {
   const session = useSession()
   const server = useServer()
   const indexing = useIndexing()
-  const { config, features } = useConfig()
+  const { config, features, updateConfig, saveConfig } = useConfig()
   const provider = useProvider()
   const language = useLanguage()
   const vscode = useVSCode()
@@ -142,6 +142,7 @@ export const PromptInput: Component<PromptInputProps> = (props) => {
   const [reviewComments, setReviewComments] = createSignal<ReviewComment[]>([])
   const [enhancing, setEnhancing] = createSignal(false)
   const [autoApprove, setAutoApprove] = createSignal(false)
+  const sandbox = () => config().experimental?.sandbox ?? false
   let enhanceCounter = 0
   let preEnhanceText: string | null = null
 
@@ -1064,6 +1065,34 @@ export const PromptInput: Component<PromptInputProps> = (props) => {
               <Icon name="shield" size="small" />
             </Button>
           </Tooltip>
+          <Tooltip
+            value={
+              sandbox()
+                ? language.t("prompt.action.sandbox.enabled")
+                : language.t("prompt.action.sandbox.disabled")
+            }
+            placement="top"
+          >
+            <Button
+              variant="ghost"
+              size="small"
+              onClick={() => {
+                updateConfig({
+                  experimental: { ...config().experimental, sandbox: !sandbox() },
+                })
+                saveConfig()
+              }}
+              aria-label={
+                sandbox()
+                  ? language.t("prompt.action.sandbox.disable")
+                  : language.t("prompt.action.sandbox.enable")
+              }
+              aria-pressed={sandbox()}
+              class={`prompt-sandbox-button ${sandbox() ? "prompt-sandbox-button--active" : ""}`}
+            >
+              <Icon name="lock" size="small" />
+            </Button>
+          </Tooltip>
           <Tooltip value={language.t("prompt.action.enhance")} placement="top">
             <Button
               variant="ghost"
diff --git a/packages/kilo-vscode/webview-ui/src/components/settings/ExperimentalTab.tsx b/packages/kilo-vscode/webview-ui/src/components/settings/ExperimentalTab.tsx
index 30c240b4f9..3f0422aa27 100644
--- a/packages/kilo-vscode/webview-ui/src/components/settings/ExperimentalTab.tsx
+++ b/packages/kilo-vscode/webview-ui/src/components/settings/ExperimentalTab.tsx
@@ -171,7 +171,6 @@ const ExperimentalTab: Component = () => {
         <SettingsRow
           title={language.t("settings.experimental.mcpTimeout.title")}
           description={language.t("settings.experimental.mcpTimeout.description")}
-          last
         >
           <TextField
             value={String(experimental().mcp_timeout ?? 60000)}
@@ -183,6 +182,20 @@ const ExperimentalTab: Component = () => {
             }}
           />
         </SettingsRow>
+
+        <SettingsRow
+          title={language.t("settings.experimental.sandbox.title")}
+          description={language.t("settings.experimental.sandbox.description")}
+          last
+        >
+          <Switch
+            checked={experimental().sandbox ?? false}
+            onChange={(checked) => updateExperimental("sandbox", checked)}
+            hideLabel
+          >
+            {language.t("settings.experimental.sandbox.title")}
+          </Switch>
+        </SettingsRow>
       </Card>
 
       {/* Tool toggles */}
diff --git a/packages/kilo-vscode/webview-ui/src/i18n/en.ts b/packages/kilo-vscode/webview-ui/src/i18n/en.ts
index 4c7b9bf639..b4de7f1370 100644
--- a/packages/kilo-vscode/webview-ui/src/i18n/en.ts
+++ b/packages/kilo-vscode/webview-ui/src/i18n/en.ts
@@ -283,6 +283,10 @@ export const dict = {
   "prompt.action.autoApprove.disable": "Disable auto-approve",
   "prompt.action.autoApprove.enabled": "Auto-approve is enabled. Permission prompts will be approved automatically.",
   "prompt.action.autoApprove.disabled": "Auto-approve is disabled. Click to approve permission prompts automatically.",
+  "prompt.action.sandbox.enable": "Enable sandbox",
+  "prompt.action.sandbox.disable": "Disable sandbox",
+  "prompt.action.sandbox.enabled": "Sandbox is enabled. Agent shell commands are confined to the project and Kilo directories.",
+  "prompt.action.sandbox.disabled": "Sandbox is disabled. Click to confine agent shell command writes to the project and Kilo directories.",
   "prompt.action.resetModel": "Reset model to default",
   "prompt.action.enhanceDescription":
     "The 'Enhance Prompt' button helps improve your prompt by providing additional context, clarification, or rephrasing. Try typing a prompt in here and clicking the button again to see how it works.",
@@ -1302,6 +1306,9 @@ export const dict = {
   "settings.models.speechToTextModel.description": "Choose the Kilo Gateway transcription model for voice input.",
   "settings.experimental.continueOnDeny.title": "Continue on Deny",
   "settings.experimental.continueOnDeny.description": "Continue the agent loop when a permission is denied",
+  "settings.experimental.sandbox.title": "Sandbox",
+  "settings.experimental.sandbox.description":
+    "Run agent shell commands inside an OS-level sandbox that restricts writes to the project and Kilo state directories",
   "settings.experimental.mcpTimeout.title": "MCP Timeout (ms)",
   "settings.experimental.mcpTimeout.description": "Timeout for MCP server requests in milliseconds",
   "settings.experimental.remote.title": "Remote Control",
diff --git a/packages/kilo-vscode/webview-ui/src/styles/prompt-input.css b/packages/kilo-vscode/webview-ui/src/styles/prompt-input.css
index 86a473842f..b1663b8d24 100644
--- a/packages/kilo-vscode/webview-ui/src/styles/prompt-input.css
+++ b/packages/kilo-vscode/webview-ui/src/styles/prompt-input.css
@@ -584,6 +584,30 @@
   box-shadow: 0 0 0 1px var(--surface-base, var(--vscode-editor-background));
 }
 
+.prompt-sandbox-button {
+  position: relative;
+}
+
+.prompt-sandbox-button--active {
+  color: var(--vscode-testing-iconPassed, #73c991);
+
+  [data-slot="icon-svg"] {
+    color: currentColor !important;
+  }
+}
+
+.prompt-sandbox-button--active::after {
+  content: "";
+  position: absolute;
+  right: 4px;
+  bottom: 4px;
+  width: 5px;
+  height: 5px;
+  border-radius: 999px;
+  background: var(--vscode-testing-iconPassed, #73c991);
+  box-shadow: 0 0 0 1px var(--surface-base, var(--vscode-editor-background));
+}
+
 .prompt-speech-button {
   position: relative;
 }
diff --git a/packages/kilo-vscode/webview-ui/src/types/messages/config.ts b/packages/kilo-vscode/webview-ui/src/types/messages/config.ts
index aa4f427184..3cd6aee6a6 100644
--- a/packages/kilo-vscode/webview-ui/src/types/messages/config.ts
+++ b/packages/kilo-vscode/webview-ui/src/types/messages/config.ts
@@ -44,6 +44,7 @@ export interface ExperimentalConfig {
   primary_tools?: string[]
   continue_loop_on_deny?: boolean
   mcp_timeout?: number
+  sandbox?: boolean
 }
 
 export interface CommitMessageConfig {
diff --git a/packages/opencode/src/config/config.ts b/packages/opencode/src/config/config.ts
index 205ec87cb7..d433b1c3ba 100644
--- a/packages/opencode/src/config/config.ts
+++ b/packages/opencode/src/config/config.ts
@@ -403,6 +403,11 @@ export const Info = Schema.Struct({
       continue_loop_on_deny: Schema.optional(Schema.Boolean).annotate({
         description: "Continue the agent loop when a tool call is denied",
       }),
+      // kilocode_change start
+      sandbox: Schema.optional(Schema.Boolean).annotate({
+        description: "Run agent shell commands inside an OS-level sandbox that restricts writes to the project and Kilo state directories",
+      }),
+      // kilocode_change end
       mcp_timeout: Schema.optional(PositiveInt).annotate({
         description: "Timeout in milliseconds for model context protocol (MCP) requests",
       }),
diff --git a/packages/opencode/src/effect/app-runtime.ts b/packages/opencode/src/effect/app-runtime.ts
index 3f486c59f2..1c65eedaf4 100644
--- a/packages/opencode/src/effect/app-runtime.ts
+++ b/packages/opencode/src/effect/app-runtime.ts
@@ -16,6 +16,7 @@ import { Snapshot } from "@/snapshot"
 import { Plugin } from "@/plugin"
 import { ModelsDev } from "@opencode-ai/core/models-dev"
 import { ModelCache } from "@/provider/model-cache" // kilocode_change
+import { layer as sandboxFsRaw } from "@/kilocode/sandbox/fs-layer" // kilocode_change
 import { Provider } from "@/provider/provider"
 import { ProviderAuth } from "@/provider/auth"
 import { Agent } from "@/agent/agent"
@@ -60,9 +61,13 @@ import { BackgroundJob } from "@/background/job"
 import { EventV2Bridge } from "@/event-v2-bridge"
 import { RuntimeFlags } from "@/effect/runtime-flags"
 
+// kilocode_change start - wrap AppFileSystem with sandbox enforcement layer
+const SandboxFsLayer = sandboxFsRaw.pipe(Layer.provide(Layer.mergeAll(AppFileSystem.defaultLayer, Config.defaultLayer)))
+// kilocode_change end
+
 const CoreLayer = Layer.mergeAll(
   Npm.defaultLayer,
-  AppFileSystem.defaultLayer,
+  SandboxFsLayer, // kilocode_change - was AppFileSystem.defaultLayer
   Bus.defaultLayer,
   Auth.defaultLayer,
   Account.defaultLayer,
diff --git a/packages/opencode/src/kilocode/sandbox/fs-layer.ts b/packages/opencode/src/kilocode/sandbox/fs-layer.ts
new file mode 100644
index 0000000000..7788485e2d
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/fs-layer.ts
@@ -0,0 +1,93 @@
+import { Effect, Layer } from "effect"
+import { AppFileSystem } from "@opencode-ai/core/filesystem"
+import { Config } from "@/config/config"
+import { InstanceState } from "@/effect/instance-state"
+import { Filesystem } from "@/util/filesystem"
+import { available } from "./seatbelt"
+import { resolve, withExternalDirs, type Scope } from "./scope"
+
+function longestExistingAncestor(p: string): string {
+  let dir = p
+  let rest = ""
+  const fs = require("fs")
+  while (dir && dir !== "/" && !fs.existsSync(dir)) {
+    const idx = dir.lastIndexOf("/")
+    rest = `${dir.slice(idx)}${rest}`
+    dir = dir.slice(0, idx)
+  }
+  if (!dir) return Filesystem.resolve(p)
+  return Filesystem.resolve(dir) + rest
+}
+
+function isUnder(child: string, parent: string): boolean {
+  if (child === parent) return true
+  if (parent === "/") return true
+  return child.startsWith(`${parent}/`)
+}
+
+function writable(scope: Scope, filepath: string): boolean {
+  const target = longestExistingAncestor(filepath)
+  for (const root of scope.writableRoots) {
+    if (!isUnder(target, root.path)) continue
+    for (const sub of root.readonlySubpaths) {
+      if (isUnder(target, sub) || target === sub) return false
+    }
+    return true
+  }
+  return false
+}
+
+function externalDirAllows(cfg: Config.Info): string[] {
+  const rule = cfg.permission?.external_directory
+  if (!rule) return []
+  if (typeof rule === "string") return rule === "allow" ? ["*"] : []
+  const patterns: string[] = []
+  for (const [pattern, action] of Object.entries(rule)) {
+    if (action === "allow") patterns.push(pattern)
+  }
+  return patterns
+}
+
+function wrap(fs: AppFileSystem.Interface, config: Config.Interface): AppFileSystem.Interface {
+  const guard = (path: string) =>
+    Effect.gen(function* () {
+      const cfg = yield* config.get()
+      if (!cfg.experimental?.sandbox) return
+      if (process.platform !== "darwin" || !available()) return
+      const ctx = yield* InstanceState.context
+      const scope = withExternalDirs(resolve(ctx), externalDirAllows(cfg))
+      if (!writable(scope, path)) {
+        throw new Error(
+          `Sandbox blocked write to ${path}: outside the allowed project and Kilo directories. ` +
+            `To allow this directory, approve it as an external directory or disable the sandbox.`,
+        )
+      }
+    })
+
+  return {
+    ...fs,
+    writeFile: (path, data) => Effect.gen(function* () { yield* guard(path); return yield* fs.writeFile(path, data) }),
+    writeFileString: (path, data) => Effect.gen(function* () { yield* guard(path); return yield* fs.writeFileString(path, data) }),
+    writeJson: (path, data, mode) => Effect.gen(function* () { yield* guard(path); return yield* fs.writeJson(path, data, mode) }),
+    ensureDir: (path) => Effect.gen(function* () { yield* guard(path); return yield* fs.ensureDir(path) }),
+    writeWithDirs: (path, content, mode) => Effect.gen(function* () { yield* guard(path); return yield* fs.writeWithDirs(path, content, mode) }),
+    makeDirectory: (path) => Effect.gen(function* () { yield* guard(path); return yield* fs.makeDirectory(path) }),
+    rename: (oldPath, newPath) => Effect.gen(function* () { yield* guard(oldPath); yield* guard(newPath); return yield* fs.rename(oldPath, newPath) }),
+    copyFile: (oldPath, newPath) => Effect.gen(function* () { yield* guard(newPath); return yield* fs.copyFile(oldPath, newPath) }),
+    copy: (oldPath, newPath) => Effect.gen(function* () { yield* guard(newPath); return yield* fs.copy(oldPath, newPath) }),
+    remove: (path) => Effect.gen(function* () { yield* guard(path); return yield* fs.remove(path) }),
+    chmod: (path, mode) => Effect.gen(function* () { yield* guard(path); return yield* fs.chmod(path, mode) }),
+    truncate: (path, size) => Effect.gen(function* () { yield* guard(path); return yield* fs.truncate(path, size) }),
+    link: (target, linkPath) => Effect.gen(function* () { yield* guard(linkPath); return yield* fs.link(target, linkPath) }),
+    symlink: (target, linkPath) => Effect.gen(function* () { yield* guard(linkPath); return yield* fs.symlink(target, linkPath) }),
+  }
+}
+
+export const layer = Layer.effect(
+  AppFileSystem.Service,
+  Effect.gen(function* () {
+    const inner = yield* AppFileSystem.Service
+    const config = yield* Config.Service
+    return AppFileSystem.Service.of(wrap(inner, config))
+  }),
+)
diff --git a/packages/opencode/src/kilocode/sandbox/guard.ts b/packages/opencode/src/kilocode/sandbox/guard.ts
new file mode 100644
index 0000000000..eb5c49e3d2
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/guard.ts
@@ -0,0 +1,78 @@
+import { Effect } from "effect"
+import { Config } from "@/config/config"
+import { InstanceState } from "@/effect/instance-state"
+import { Filesystem } from "@/util/filesystem"
+import type { InstanceContext } from "@/project/instance-context"
+import { available } from "./seatbelt"
+import { resolve, withExternalDirs, type Scope } from "./scope"
+
+function longestExistingAncestor(p: string): string {
+  let dir = p
+  let rest = ""
+  const fs = require("fs")
+  while (dir && dir !== "/" && !fs.existsSync(dir)) {
+    const idx = dir.lastIndexOf("/")
+    rest = `${dir.slice(idx)}${rest}`
+    dir = dir.slice(0, idx)
+  }
+  if (!dir) return Filesystem.resolve(p)
+  return Filesystem.resolve(dir) + rest
+}
+
+function isWritable(scope: Scope, filepath: string): boolean {
+  const target = longestExistingAncestor(filepath)
+
+  for (const root of scope.writableRoots) {
+    if (!isUnder(target, root.path)) continue
+
+    for (const sub of root.readonlySubpaths) {
+      if (isUnder(target, sub) || target === sub) return false
+    }
+    return true
+  }
+  return false
+}
+
+function isUnder(child: string, parent: string): boolean {
+  if (child === parent) return true
+  if (parent === "/") return true
+  return child.startsWith(`${parent}/`)
+}
+
+function externalDirAllows(cfg: Config.Info): string[] {
+  const rule = cfg.permission?.external_directory
+  if (!rule) return []
+  if (typeof rule === "string") {
+    return rule === "allow" ? ["*"] : []
+  }
+  const patterns: string[] = []
+  for (const [pattern, action] of Object.entries(rule)) {
+    if (action === "allow") patterns.push(pattern)
+  }
+  return patterns
+}
+
+export function assertWritable(
+  config: Config.Interface,
+  filepath: string,
+): Effect.Effect<void> {
+  return Effect.gen(function* () {
+    const cfg = yield* config.get()
+    if (!cfg.experimental?.sandbox) return
+    if (process.platform !== "darwin" || !available()) return
+
+    const ctx = yield* InstanceState.context
+    const scope = enrichedScope(ctx, cfg)
+
+    if (!isWritable(scope, filepath)) {
+      throw new Error(
+        `Sandbox blocked write to ${filepath}: outside the allowed project and Kilo directories. ` +
+          `To allow this directory, approve it as an external directory or disable the sandbox.`,
+      )
+    }
+  })
+}
+
+export function enrichedScope(ctx: InstanceContext, cfg: Config.Info): Scope {
+  return withExternalDirs(resolve(ctx), externalDirAllows(cfg))
+}
diff --git a/packages/opencode/src/kilocode/sandbox/index.ts b/packages/opencode/src/kilocode/sandbox/index.ts
new file mode 100644
index 0000000000..0793576099
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/index.ts
@@ -0,0 +1,6 @@
+export { generate, available } from "./seatbelt"
+export { wrap } from "./spawn"
+export { resolve, withExternalDirs } from "./scope"
+export { assertWritable, enrichedScope } from "./guard"
+export { layer as fsLayer } from "./fs-layer"
+export type { Scope, Root } from "./scope"
diff --git a/packages/opencode/src/kilocode/sandbox/scope.ts b/packages/opencode/src/kilocode/sandbox/scope.ts
new file mode 100644
index 0000000000..09e5f5232e
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/scope.ts
@@ -0,0 +1,81 @@
+import { Global } from "@opencode-ai/core/global"
+import { Filesystem } from "@/util/filesystem"
+import type { InstanceContext } from "@/project/instance-context"
+
+export interface Root {
+  path: string
+  readonlySubpaths: string[]
+}
+
+export interface Scope {
+  writableRoots: Root[]
+}
+
+// Only .git is hard-protected from writes. .kilo is intentionally left writable
+// because ConfigProtection (kilocode/permission/config-paths.ts) already forces
+// an ask prompt for edits to .kilo/ config files — the sandbox should not
+// override that softer, user-consent-based gate with a hard block.
+const PROTECTED_METADATA_NAMES = [".git"]
+
+function real(p: string): string {
+  return Filesystem.resolve(p)
+}
+
+function addRoot(writable: Root[], dir: string) {
+  const r = real(dir)
+  if (!writable.some((w) => w.path === r)) writable.push({ path: r, readonlySubpaths: [] })
+}
+
+function protectMeta(root: Root) {
+  for (const name of PROTECTED_METADATA_NAMES) {
+    const meta = `${root.path}/${name}`
+    if (!root.readonlySubpaths.includes(meta)) root.readonlySubpaths.push(meta)
+  }
+}
+
+export function resolve(ctx: InstanceContext): Scope {
+  const writable: Root[] = []
+
+  if (ctx.worktree !== "/") addRoot(writable, ctx.worktree)
+  addRoot(writable, ctx.directory)
+  for (const s of ctx.project.sandboxes ?? []) addRoot(writable, s)
+
+  const dirs = [
+    Global.Path.data,
+    Global.Path.cache,
+    Global.Path.config,
+    Global.Path.state,
+    Global.Path.tmp,
+    Global.Path.bin,
+    Global.Path.log,
+    Global.Path.repos,
+  ]
+  for (const dir of dirs) addRoot(writable, dir)
+
+  for (const root of writable) protectMeta(root)
+
+  return { writableRoots: writable }
+}
+
+function expandHome(p: string): string {
+  if (p.startsWith("~/")) return real(`${process.env.HOME ?? ""}${p.slice(1)}`)
+  if (p === "~") return real(process.env.HOME ?? "")
+  return p
+}
+
+export function withExternalDirs(scope: Scope, patterns: string[]): Scope {
+  const writable = [...scope.writableRoots]
+  for (const pattern of patterns) {
+    let dir = expandHome(pattern.trim())
+    if (dir.endsWith("/*")) dir = dir.slice(0, -2)
+    else if (dir.endsWith("/")) dir = dir.slice(0, -1)
+    if (!dir || dir === "*" || dir.includes("*")) continue
+    let root: Root | undefined = writable.find((w) => w.path === real(dir))
+    if (!root) {
+      root = { path: real(dir), readonlySubpaths: [] }
+      writable.push(root)
+    }
+    protectMeta(root)
+  }
+  return { writableRoots: writable }
+}
diff --git a/packages/opencode/src/kilocode/sandbox/seatbelt-base.ts b/packages/opencode/src/kilocode/sandbox/seatbelt-base.ts
new file mode 100644
index 0000000000..6478064cc3
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/seatbelt-base.ts
@@ -0,0 +1,114 @@
+export const base = `(version 1)
+
+(deny default)
+
+(allow process-exec)
+(allow process-fork)
+(allow signal (target same-sandbox))
+(allow process-info* (target same-sandbox))
+
+(allow file-write-data
+  (require-all
+    (path "/dev/null")
+    (vnode-type CHARACTER-DEVICE)))
+
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.model")
+  (sysctl-name "hw.memsize")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name-prefix "hw.optional.arm.")
+  (sysctl-name-prefix "hw.optional.armv8_")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.pagesize")
+  (sysctl-name "hw.physicalcpu")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.logicalcpu")
+  (sysctl-name "hw.cpufrequency")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "machdep.cpu.brand_string")
+  (sysctl-name "kern.argmax")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.maxproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name "vm.loadavg")
+  (sysctl-name-prefix "hw.perflevel")
+  (sysctl-name-prefix "kern.proc.pgrp.")
+  (sysctl-name-prefix "kern.proc.pid.")
+  (sysctl-name-prefix "net.routetable.")
+)
+
+(allow sysctl-write
+  (sysctl-name "kern.grade_cputype"))
+
+(allow iokit-open
+  (iokit-registry-entry-class "RootDomainUserClient"))
+
+(allow mach-lookup
+  (global-name "com.apple.system.opendirectoryd.libinfo"))
+
+(allow ipc-posix-sem)
+
+(allow ipc-posix-shm-read-data
+  ipc-posix-shm-write-create
+  ipc-posix-shm-write-unlink
+  (ipc-posix-name-regex #"^/__KMP_REGISTERED_LIB_[0-9]+$"))
+
+(allow mach-lookup
+  (global-name "com.apple.PowerManagement.control"))
+
+(allow pseudo-tty)
+(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
+(allow file-read* file-write*
+  (require-all
+    (regex #"^/dev/ttys[0-9]+")
+    (extension "com.apple.sandbox.pty")))
+(allow file-ioctl (regex #"^/dev/ttys[0-9]+"))
+
+(allow ipc-posix-shm-read* (ipc-posix-name-prefix "apple.cfprefs."))
+(allow mach-lookup
+  (global-name "com.apple.cfprefsd.daemon")
+  (global-name "com.apple.cfprefsd.agent")
+  (local-name "com.apple.cfprefsd.agent"))
+(allow user-preference-read)
+
+; network is not confined by the file-level sandbox; allow it fully
+(allow network-outbound)
+(allow network-inbound)
+(allow system-socket)
+(allow mach-lookup
+  (global-name "com.apple.bsd.dirhelper")
+  (global-name "com.apple.system.opendirectoryd.membership")
+  (global-name "com.apple.SecurityServer")
+  (global-name "com.apple.networkd")
+  (global-name "com.apple.ocspd")
+  (global-name "com.apple.trustd.agent")
+  (global-name "com.apple.SystemConfiguration.DNSConfiguration")
+  (global-name "com.apple.SystemConfiguration.configd"))
+(allow sysctl-read (sysctl-name-regex #"^net.routetable"))
+`
diff --git a/packages/opencode/src/kilocode/sandbox/seatbelt.ts b/packages/opencode/src/kilocode/sandbox/seatbelt.ts
new file mode 100644
index 0000000000..55eb5cc436
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/seatbelt.ts
@@ -0,0 +1,84 @@
+import { base } from "./seatbelt-base"
+import type { Scope, Root } from "./scope"
+
+const SEATBELT = "/usr/bin/sandbox-exec"
+
+// Only .git is hard-protected from writes. .kilo is left writable because
+// ConfigProtection already gates .kilo/ edits with an ask prompt.
+const META = [".git"]
+
+function escapeRegex(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+}
+
+function protectedMetaRegex(root: string, name: string): string {
+  let r = root
+  while (r.length > 1 && r.endsWith("/")) r = r.slice(0, -1)
+  const er = escapeRegex(r)
+  const en = escapeRegex(name)
+  if (r === "/") return `^/${en}(/.*)?$`
+  return `^${er}/${en}(/.*)?$`
+}
+
+interface Param {
+  key: string
+  value: string
+}
+
+function buildWritePolicy(roots: Root[]): { policy: string; params: Param[] } {
+  const parts: string[] = []
+  const params: Param[] = []
+
+  roots.forEach((root, i) => {
+    const rp = `WRITABLE_ROOT_${i}`
+    params.push({ key: rp, value: root.path })
+
+    const require: string[] = [`(subpath (param "${rp}"))`]
+
+    root.readonlySubpaths.forEach((sub, j) => {
+      const ep = `${rp}_EXCL_${j}`
+      params.push({ key: ep, value: sub })
+      require.push(`(require-not (literal (param "${ep}")))`)
+      require.push(`(require-not (subpath (param "${ep}")))`)
+    })
+
+    for (const name of META) {
+      if (root.readonlySubpaths.some((s) => s === `${root.path}/${name}`)) continue
+      const re = protectedMetaRegex(root.path, name).replace(/"/g, '\\"')
+      require.push(`(require-not (regex #"${re}"))`)
+    }
+
+    parts.push(`(require-all ${require.join(" ")} )`)
+  })
+
+  if (parts.length === 0) return { policy: "", params }
+  return { policy: `(allow file-write*\n${parts.join(" ")}\n)`, params }
+}
+
+export interface Command {
+  command: string
+  args: string[]
+}
+
+export function available(): boolean {
+  try {
+    const fs = require("fs")
+    return fs.existsSync(SEATBELT)
+  } catch {
+    return false
+  }
+}
+
+export function generate(scope: Scope, command: string, args: string[]): Command {
+  const write = buildWritePolicy(scope.writableRoots)
+
+  const policy = [base, "; reads are not confined by the file-level sandbox\n(allow file-read*)", write.policy].join(
+    "\n",
+  )
+
+  const sbArgs: string[] = ["-p", policy]
+  for (const p of write.params) sbArgs.push(`-D${p.key}=${p.value}`)
+  sbArgs.push("--", command, ...args)
+
+  return { command: SEATBELT, args: sbArgs }
+}
diff --git a/packages/opencode/src/kilocode/sandbox/spawn.ts b/packages/opencode/src/kilocode/sandbox/spawn.ts
new file mode 100644
index 0000000000..f75fd1d111
--- /dev/null
+++ b/packages/opencode/src/kilocode/sandbox/spawn.ts
@@ -0,0 +1,17 @@
+import { generate, available } from "./seatbelt"
+import type { Scope } from "./scope"
+
+export interface WrapResult {
+  sandboxed: boolean
+  command: string
+  args: string[]
+}
+
+export function wrap(scope: Scope, command: string, args: string[]): WrapResult {
+  if (process.platform === "darwin" && available()) {
+    const r = generate(scope, command, args)
+    return { sandboxed: true, command: r.command, args: r.args }
+  }
+
+  return { sandboxed: false, command, args }
+}
diff --git a/packages/opencode/src/tool/shell.ts b/packages/opencode/src/tool/shell.ts
index 99f4eb2ac5..d5eed949a3 100644
--- a/packages/opencode/src/tool/shell.ts
+++ b/packages/opencode/src/tool/shell.ts
@@ -20,6 +20,7 @@ import * as Truncate from "./truncate"
 import { Plugin } from "@/plugin"
 import { normalizeUrls } from "@/kilocode/util/url" // kilocode_change
 import { CommandTimeout } from "@/kilocode/command-timeout" // kilocode_change
+import * as Sandbox from "@/kilocode/sandbox" // kilocode_change
 import { ChildProcess } from "effect/unstable/process"
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner"
 import { ShellPrompt, type Parameters } from "./shell/prompt"
@@ -310,6 +311,7 @@ const ask = Effect.fn("ShellTool.ask")(function* (
   })
 })
 
+// kilocode_change start - sandbox wrapper
 function cmd(shell: string, command: string, cwd: string, env: NodeJS.ProcessEnv) {
   if (process.platform === "win32" && Shell.ps(shell)) {
     // kilocode_change start - encoded PowerShell args
@@ -330,6 +332,32 @@ function cmd(shell: string, command: string, cwd: string, env: NodeJS.ProcessEnv
     detached: process.platform !== "win32",
   })
 }
+
+function sandboxedCmd(
+  scope: Sandbox.Scope,
+  shell: string,
+  command: string,
+  cwd: string,
+  env: NodeJS.ProcessEnv,
+) {
+  if (process.platform === "win32" && Shell.ps(shell)) {
+    return ChildProcess.make(shell, Shell.args(shell, command, cwd), {
+      cwd,
+      env,
+      stdin: "ignore",
+      detached: false,
+    })
+  }
+
+  const wrapped = Sandbox.wrap(scope, shell, ["-c", command])
+  return ChildProcess.make(wrapped.command, wrapped.args, {
+    cwd,
+    env,
+    stdin: "ignore",
+    detached: process.platform !== "win32",
+  })
+}
+// kilocode_change end
 const parser = lazy(async () => {
   const { Parser } = await import("web-tree-sitter")
   const { default: treeWasm } = await import("web-tree-sitter/tree-sitter.wasm" as string, {
@@ -467,6 +495,7 @@ export const ShellTool = Tool.define(
         env: NodeJS.ProcessEnv
         timeout: number
         description: string
+        sandbox?: boolean // kilocode_change
       },
       ctx: Tool.Context,
     ) {
@@ -517,7 +546,21 @@ export const ShellTool = Tool.define(
       const code: number | null = yield* Effect.scoped(
         Effect.gen(function* () {
           yield* Effect.addFinalizer(closeSink)
-          const handle = yield* spawner.spawn(cmd(input.shell, input.command, input.cwd, input.env))
+          // kilocode_change start - sandbox wrapping
+          const handle = yield* spawner.spawn(
+            input.sandbox
+              ? sandboxedCmd(
+                  // kilocode_change start - enrich sandbox scope with approved external dirs
+                  Sandbox.enrichedScope(yield* InstanceState.context, yield* config.get()),
+                  input.shell,
+                  input.command,
+                  input.cwd,
+                  input.env,
+                )
+              // kilocode_change end
+              : cmd(input.shell, input.command, input.cwd, input.env),
+          )
+          // kilocode_change end
 
           yield* Effect.forkScoped(
             Stream.runForEach(Stream.decodeText(handle.all), (chunk) => {
@@ -675,6 +718,8 @@ export const ShellTool = Tool.define(
                 }),
               )
 
+              // kilocode_change start - read config fresh per execution
+              const liveCfg = yield* config.get()
               return yield* run(
                 {
                   shell,
@@ -683,9 +728,11 @@ export const ShellTool = Tool.define(
                   env: yield* shellEnv(ctx, cwd),
                   timeout,
                   description: params.description ?? params.command, // kilocode_change
+                  sandbox: liveCfg.experimental?.sandbox ?? false,
                 },
                 ctx,
               )
+              // kilocode_change end
             }),
         }
       })
diff --git a/packages/opencode/test/kilocode/sandbox/seatbelt.test.ts b/packages/opencode/test/kilocode/sandbox/seatbelt.test.ts
new file mode 100644
index 0000000000..040ef82e62
--- /dev/null
+++ b/packages/opencode/test/kilocode/sandbox/seatbelt.test.ts
@@ -0,0 +1,139 @@
+import { test, expect, describe } from "bun:test"
+import { generate } from "@/kilocode/sandbox/seatbelt"
+import type { Scope } from "@/kilocode/sandbox/scope"
+
+function makeScope(overrides: Partial<Scope> = {}): Scope {
+  return {
+    writableRoots: [],
+    ...overrides,
+  }
+}
+
+describe("seatbelt.generate", () => {
+  test("produces sandbox-exec command with -p flag", () => {
+    const result = generate(makeScope(), "/bin/echo", ["hello"])
+    expect(result.command).toBe("/usr/bin/sandbox-exec")
+    expect(result.args[0]).toBe("-p")
+    expect(typeof result.args[1]).toBe("string")
+  })
+
+  test("ends with -- and the original command", () => {
+    const result = generate(makeScope(), "/bin/echo", ["hello", "world"])
+    const tail = result.args.slice(-4)
+    expect(tail).toEqual(["--", "/bin/echo", "hello", "world"])
+  })
+
+  test("profile starts with version 1 and deny default", () => {
+    const result = generate(makeScope(), "/bin/echo", [])
+    const policy = result.args[1]
+    expect(policy).toContain("(version 1)")
+    expect(policy).toContain("(deny default)")
+  })
+
+  test("reads are always allowed (file-level sandbox confines writes only)", () => {
+    const result = generate(makeScope(), "/bin/echo", [])
+    expect(result.args[1]).toContain("(allow file-read*)")
+  })
+
+  test("writable root without exclusions produces a require-all subpath", () => {
+    const result = generate(
+      makeScope({
+        writableRoots: [{ path: "/private/tmp/proj", readonlySubpaths: [] }],
+      }),
+      "/bin/echo",
+      [],
+    )
+    const policy = result.args[1]
+    expect(policy).toContain('(subpath (param "WRITABLE_ROOT_0"))')
+    expect(result.args).toContain("-DWRITABLE_ROOT_0=/private/tmp/proj")
+  })
+
+  test("writable root with exclusions produces require-all with require-not", () => {
+    const result = generate(
+      makeScope({
+        writableRoots: [
+          {
+            path: "/private/tmp/proj",
+            readonlySubpaths: ["/private/tmp/proj/.git"],
+          },
+        ],
+      }),
+      "/bin/echo",
+      [],
+    )
+    const policy = result.args[1]
+    expect(policy).toContain("(require-all")
+    expect(policy).toContain('(subpath (param "WRITABLE_ROOT_0"))')
+    expect(policy).toContain('(require-not (literal (param "WRITABLE_ROOT_0_EXCL_0")))')
+    expect(policy).toContain('(require-not (subpath (param "WRITABLE_ROOT_0_EXCL_0")))')
+    expect(result.args).toContain("-DWRITABLE_ROOT_0_EXCL_0=/private/tmp/proj/.git")
+  })
+
+  test("adds regex denies for protected metadata not already in exclusions", () => {
+    const result = generate(
+      makeScope({
+        writableRoots: [
+          {
+            path: "/private/tmp/proj",
+            readonlySubpaths: [],
+          },
+        ],
+      }),
+      "/bin/echo",
+      [],
+    )
+    // .git is not in exclusions, so it gets a regex deny
+    expect(result.args[1]).toContain("\\.git")
+  })
+
+  test("protected metadata already in exclusions is not duplicated as regex", () => {
+    const result = generate(
+      makeScope({
+        writableRoots: [
+          {
+            path: "/private/tmp/proj",
+            readonlySubpaths: ["/private/tmp/proj/.git"],
+          },
+        ],
+      }),
+      "/bin/echo",
+      [],
+    )
+    const policy = result.args[1]
+    expect(policy).not.toContain("\\.git")
+  })
+
+  test("network is always allowed (file-level sandbox does not confine network)", () => {
+    const result = generate(makeScope(), "/bin/echo", [])
+    const policy = result.args[1]
+    expect(policy).toContain("(allow network-outbound)")
+    expect(policy).toContain("(allow network-inbound)")
+    expect(policy).toContain("com.apple.trustd.agent")
+    expect(policy).toContain("com.apple.networkd")
+  })
+
+  test("multiple writable roots get indexed params", () => {
+    const result = generate(
+      makeScope({
+        writableRoots: [
+          { path: "/private/tmp/proj", readonlySubpaths: [] },
+          { path: "/private/tmp/kilo", readonlySubpaths: [] },
+        ],
+      }),
+      "/bin/echo",
+      [],
+    )
+    expect(result.args).toContain("-DWRITABLE_ROOT_0=/private/tmp/proj")
+    expect(result.args).toContain("-DWRITABLE_ROOT_1=/private/tmp/kilo")
+    const policy = result.args[1]
+    expect(policy).toContain('(subpath (param "WRITABLE_ROOT_0"))')
+    expect(policy).toContain('(subpath (param "WRITABLE_ROOT_1"))')
+  })
+
+  test("no writable roots produces no write policy", () => {
+    const result = generate(makeScope({ writableRoots: [] }), "/bin/echo", [])
+    const policy = result.args[1]
+    expect(policy).toContain("(allow file-read*)")
+    expect(policy).not.toContain("(allow file-write*")
+  })
+})
diff --git a/packages/sdk/js/src/v2/gen/types.gen.ts b/packages/sdk/js/src/v2/gen/types.gen.ts
index 73d1dcaa6b..53db5ebe02 100644
--- a/packages/sdk/js/src/v2/gen/types.gen.ts
+++ b/packages/sdk/js/src/v2/gen/types.gen.ts
@@ -1540,6 +1540,7 @@ export type Config = {
     openTelemetry?: boolean
     primary_tools?: Array<string>
     continue_loop_on_deny?: boolean
+    sandbox?: boolean
     mcp_timeout?: number
     policies?: Array<ConfigV2ExperimentalPolicy>
   }
diff --git a/packages/ui/src/components/icon.tsx b/packages/ui/src/components/icon.tsx
index dce0a7b74e..ff54c85b57 100644
--- a/packages/ui/src/components/icon.tsx
+++ b/packages/ui/src/components/icon.tsx
@@ -86,6 +86,7 @@ const icons = {
   photo: `<path d="M16.6665 16.6666L11.6665 11.6666L9.99984 13.3333L6.6665 9.99996L3.08317 13.5833M2.9165 2.91663H17.0832V17.0833H2.9165V2.91663ZM13.3332 7.49996C13.3332 8.30537 12.6803 8.95829 11.8748 8.95829C11.0694 8.95829 10.4165 8.30537 10.4165 7.49996C10.4165 6.69454 11.0694 6.04163 11.8748 6.04163C12.6803 6.04163 13.3332 6.69454 13.3332 7.49996Z" stroke="currentColor" stroke-linecap="square"/>`,
   share: `<path d="M10.0013 12.0846L10.0013 3.33464M13.7513 6.66797L10.0013 2.91797L6.2513 6.66797M17.0846 10.418V17.0846H2.91797V10.418" stroke="currentColor" stroke-linecap="square"/>`,
   shield: `<path d="M7.49935 9.3737L9.16602 11.0404L12.4994 7.70703M9.99935 2.08203L17.0827 4.3737V9.92565C17.0827 14.0694 13.3327 16.2487 9.99935 18.047C6.66602 16.2487 2.91602 14.0694 2.91602 9.92565V4.3737L9.99935 2.08203Z" stroke="currentColor" stroke-linecap="square"/>`,
+  lock: `<path d="M5.833 8.33366V6.25033C5.833 3.71903 7.96805 1.66699 10.4993 1.66699C13.0307 1.66699 15.166 3.71903 15.166 6.25033V8.33366M4.16634 8.33366H16.833C17.7535 8.33366 18.4997 9.07985 18.4997 10.0003V16.667C18.4997 17.5875 17.7535 18.3337 16.833 18.3337H4.16634C3.24586 18.3337 2.49967 17.5875 2.49967 16.667V10.0003C2.49967 9.07985 3.24586 8.33366 4.16634 8.33366Z" stroke="currentColor" stroke-linecap="square"/>`,
   download: `<path d="M13.9583 10.6257L10 14.584L6.04167 10.6257M10 2.08398V13.959M16.25 17.9173H3.75" stroke="currentColor" stroke-linecap="square"/>`,
   menu: `<path d="M2.5 5H17.5M2.5 10H17.5M2.5 15H17.5" stroke="currentColor" stroke-linecap="square"/>`,
   server: `<rect x="3.35547" y="1.92969" width="13.2857" height="16.1429" stroke="currentColor"/><rect x="3.35547" y="11.9297" width="13.2857" height="6.14286" stroke="currentColor"/><rect x="12.8555" y="14.2852" width="1.42857" height="1.42857" fill="currentColor"/><rect x="10" y="14.2852" width="1.42857" height="1.42857" fill="currentColor"/>`,