Add an OS-level sandbox that confines agent writes to the project and Kilo
state directories. Currently macOS-only (via sandbox-exec/seatbelt), with
Linux, Windows, network isolation, and worktree isolation deferred to
follow-up issues (#11538, #11540, #11542, #11544, #11546, #11547).
Two enforcement layers:
- Bash tool: kernel-level seatbelt confinement via sandbox-exec
- File tools (write/edit/apply_patch): TS-level AppFileSystem layer wrapper
Both share the same configurable scope, which respects existing permission
config (external_directory allows, project sandboxes).
Opt-in via experimental.sandbox config toggle or the lock button in the
prompt input.
Pass the active directory alongside the worktree root into primaryPaths
so it can mirror the relative path into the primary checkout and search
each ancestor up to the root in nearest-first order. This lets nested
subdirectories inherit config and skills from intermediate primary
directories rather than only the checkout root.
Mirror the TUI's /compact and /summarize slash commands so they can be
invoked from kilo run --command. Both map to the session summarize
endpoint and require an existing session via -c or -s.
The shared command-not-found hint now also lists these built-ins so
typos surface them alongside registered slash commands.
Combine the sequential baselineDirectory and Config.Service calls
inside boot() into one Effect.gen block, reducing the number of
AppRuntime.runPromise invocations from two to one.
Introduce a primaryWorktree Effect that queries Git plumbing commands
to locate the main checkout from any linked worktree. Integrate it
into config loading so .kilo directory settings from the primary
checkout act as local-scoped fallbacks beneath the active worktree
and KILO_CONFIG_DIR overrides.
Wire primaryPaths into skill discovery so project skills installed in
the primary checkout appear as fallbacks unless overridden locally.
Refactor session family matching to consider sandbox directories and
filter out nested Git repositories when resolving worktree roots.
Convert baselineDirectory in indexing to an Effect that delegates to
primaryWorktree instead of reading Instance.project.worktree directly.
Restore the content() signal usage in the TUI text part renderer.
Provide Git.defaultLayer across all affected test layers and add
coverage for linked worktrees, submodules, paths with spaces, sandbox
project matching, and primary config directory precedence.
Move serverUrls helper into Kilo-owned src/kilocode/cli/ so it is exempt
from the annotation checker. Update all imports accordingly. Mark the
remaining Kilo-specific lines in shared upstream files with kilocode_change
markers: server.ts (Listener.urls field, import, and call sites), serve.ts
and web.ts (unified URL display blocks). Remove the circular self-import
of ./server in server.ts that was masking the intended upstream export.
Use server.urls directly in serve.ts and web.ts to avoid a redundant
networkInterfaces() call now that the Listener already carries the
precomputed values. Drop the incomplete 172.x.x.x Docker heuristic from
getNetworkIPs() and fall back to state.urls in console.ts for consistency.
Extract shared serverUrls helper in cli/server-urls.ts that computes local,
network, and bind URLs based on the resolved hostname and port. Include
urls on the Listener type returned by server.listen(). Update serve, web,
daemon, and console commands to print Local/Network lines when logging a
non-loopback bind, and fall back to the existing single-line format for
loopback binds. Add a changeset for the user-visible output change.
marius-kilocode