Add an OS-level sandbox that confines agent writes to the project and Kilo
state directories. Currently macOS-only (via sandbox-exec/seatbelt), with
Linux, Windows, network isolation, and worktree isolation deferred to
follow-up issues (#11538, #11540, #11542, #11544, #11546, #11547).
Two enforcement layers:
- Bash tool: kernel-level seatbelt confinement via sandbox-exec
- File tools (write/edit/apply_patch): TS-level AppFileSystem layer wrapper
Both share the same configurable scope, which respects existing permission
config (external_directory allows, project sandboxes).
Opt-in via experimental.sandbox config toggle or the lock button in the
prompt input.
Pass the active directory alongside the worktree root into primaryPaths
so it can mirror the relative path into the primary checkout and search
each ancestor up to the root in nearest-first order. This lets nested
subdirectories inherit config and skills from intermediate primary
directories rather than only the checkout root.
Mirror the TUI's /compact and /summarize slash commands so they can be
invoked from kilo run --command. Both map to the session summarize
endpoint and require an existing session via -c or -s.
The shared command-not-found hint now also lists these built-ins so
typos surface them alongside registered slash commands.
Combine the sequential baselineDirectory and Config.Service calls
inside boot() into one Effect.gen block, reducing the number of
AppRuntime.runPromise invocations from two to one.
Introduce a primaryWorktree Effect that queries Git plumbing commands
to locate the main checkout from any linked worktree. Integrate it
into config loading so .kilo directory settings from the primary
checkout act as local-scoped fallbacks beneath the active worktree
and KILO_CONFIG_DIR overrides.
Wire primaryPaths into skill discovery so project skills installed in
the primary checkout appear as fallbacks unless overridden locally.
Refactor session family matching to consider sandbox directories and
filter out nested Git repositories when resolving worktree roots.
Convert baselineDirectory in indexing to an Effect that delegates to
primaryWorktree instead of reading Instance.project.worktree directly.
Restore the content() signal usage in the TUI text part renderer.
Provide Git.defaultLayer across all affected test layers and add
coverage for linked worktrees, submodules, paths with spaces, sandbox
project matching, and primary config directory precedence.
marius-kilocode