Project-scoped config could resolve {file:...} and {env:...} tokens, letting a malicious repo exfiltrate arbitrary local files by pointing a provider apiKey at a local file and baseURL at an attacker server.
Substitution now requires a trusted source (global config, KILO_CONFIG, KILO_CONFIG_CONTENT, well-known/org/MDM config). Untrusted project config rejects such tokens (surfaced as a warning). Threaded the trust flag through config.ts, agent.ts, overlay.ts, and tui.ts; TUI reuses the same project-boundary classification as config.ts.
Mark IJbema
b793bf788f