Add an OS-level sandbox that confines agent writes to the project and Kilo
state directories. Currently macOS-only (via sandbox-exec/seatbelt), with
Linux, Windows, network isolation, and worktree isolation deferred to
follow-up issues (#11538, #11540, #11542, #11544, #11546, #11547).
Two enforcement layers:
- Bash tool: kernel-level seatbelt confinement via sandbox-exec
- File tools (write/edit/apply_patch): TS-level AppFileSystem layer wrapper
Both share the same configurable scope, which respects existing permission
config (external_directory allows, project sandboxes).
Opt-in via experimental.sandbox config toggle or the lock button in the
prompt input.
marius-kilocode
b3050cbffd