Mark IJbema b793bf788f fix(cli): block file/env references in untrusted project config ...

Project-scoped config could resolve {file:...} and {env:...} tokens, letting a malicious repo exfiltrate arbitrary local files by pointing a provider apiKey at a local file and baseURL at an attacker server.

Substitution now requires a trusted source (global config, KILO_CONFIG, KILO_CONFIG_CONTENT, well-known/org/MDM config). Untrusted project config rejects such tokens (surfaced as a warning). Threaded the trust flag through config.ts, agent.ts, overlay.ts, and tui.ts; TUI reuses the same project-boundary classification as config.ts.

2026-07-02 13:42:15 +02:00

..

fixtures

Merge OpenCode v1.1.42 (#67)

2026-02-02 12:47:09 +01:00

agent-color.test.ts

refactor: kilo compat for v1.15.9

2026-06-15 14:48:05 +02:00

config.test.ts

fix(cli): block file/env references in untrusted project config

2026-07-02 13:42:15 +02:00

entry-name.test.ts

refactor: kilo compat for v1.15.9

2026-06-15 14:48:05 +02:00

lsp.test.ts

refactor: kilo compat for v1.14.51

2026-06-09 08:29:02 +02:00

markdown.test.ts

refactor: remove module barrels (#24554)

2026-04-27 14:33:33 -04:00

plugin.test.ts

CLI perf: reduce deps (#22652)

2026-04-16 02:03:03 -04:00

tui.test.ts

fix(cli): block file/env references in untrusted project config

2026-07-02 13:42:15 +02:00