fix(sandbox): prevent config self-disable

[marius-kilocode]

A sandbox policy was previously derived from the live effective configuration each time a model tool ran. That configuration is intentionally writable so agents can make normal project changes, and Kilo resolves it from several locations, including the primary kilo.json[c] files, ancestor and repository configuration, global configuration, configured override directories, and legacy OpenCode-compatible files.

This made the sandbox configuration part of the authority it was supposed to constrain. A confined agent could change an effective config source to set experimental.sandbox or experimental.sandbox_restrict_network to a weaker value, wait for config invalidation or reload, and then use a later shell, web, MCP, fork, or delegated task invocation with more authority. Replacing or renaming config files, resolving config indirectly, or resuming work through a child session created equivalent paths. Restarting the backend also allowed a resumed session to initialize from the modified configuration.

This change moves confinement authority out of live model-writable configuration and into persistent session policy state.

• The effective sandbox enablement and network mode are captured when a session first enters the sandbox policy boundary. Configuration remains the default for a session that has not initialized policy yet, but it is no longer consulted for every subsequent tool invocation.
• Session policy is persisted in a dedicated Kilo state location outside project and configuration roots. The persisted snapshot survives backend and VS Code restarts, so reopening an existing session cannot pick up weaker model-written settings.
• Policy files are keyed by both session and directory, validated when read, written atomically, and removed with the corresponding session lifecycle.
• The policy store is placed outside every sandbox-writable root, and the canonical policy subtree is explicitly read-only. This prevents direct writes and renames while leaving normal Kilo state and cache locations writable.
• Forked sessions inherit the source session policy before publication. New and resumed task sessions are reconciled with the parent policy before delegated work begins.
• Delegated inheritance is monotonic. A child may retain stronger confinement, but a weaker existing child cannot reduce a confined parent's enablement or network restrictions.
• Trusted user sandbox toggles still update the selected session policy and publish the existing state-change event. Explicit configuration changes still apply to future sessions that have not initialized policy, preserving normal user control without retroactively changing an active model's authority.

The local server is another possible route around a file-based fix. If a sandboxed process can discover server credentials or reach an unauthenticated local control plane, it could request the same trusted toggle that the UI uses. To close that path:

• sandboxed child processes no longer receive KILO_SERVER_PASSWORD or KILO_SERVER_USERNAME;
• config variable substitution cannot expose those values through {env:...} references;
• Linux {file:...} substitution opens and validates one file descriptor before reading, preventing direct, symlinked, and path-swap access to /proc/.../environ;
• when the local server has no password boundary, sandboxed sessions are forced into confinement with denied networking, preventing them from reaching an unauthenticated control plane. Authenticated launches keep the configured defaults and trusted user controls.

The primary configuration scenario is a project-local kilo.json or kilo.jsonc. Legacy OpenCode-compatible files remain accepted inputs, but they do not receive special authority and are covered by the same source-independent snapshot boundary. No legacy file is created as part of policy persistence.

The practical result is that configuration remains editable data, not a model-controlled capability switch. An agent can modify kilo.json as part of normal repository work, but that write cannot increase the authority of the active session or any delegated work derived from it.

Closes #11624

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilocode/sandbox/policy.ts	211	Parent snapshot lookup still uses the current child directory key, so cross-worktree inheritance can miss a stricter stored parent snapshot.

Fix these issues in Kilo Cloud

Files Reviewed (5 files)

• packages/opencode/src/config/variable.ts
• packages/opencode/src/kilocode/sandbox/policy.ts - 1 issue
• packages/opencode/src/kilocode/sandbox/store.ts
• packages/opencode/test/kilocode/config/variable.test.ts
• packages/opencode/test/kilocode/sandbox/state.test.ts

Previous Review Summaries (2 snapshots, latest commit 801f8ff)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 801f8ff)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/kilo-sandbox/src/bubblewrap.ts	101	Literal directory denies now become recursive read-only mounts on Linux, changing literal-path semantics and blocking sibling writes.

Fix these issues in Kilo Cloud

Files Reviewed (6 files)

• packages/core/test/kilocode/linux-sandbox.test.ts
• packages/kilo-sandbox/src/bubblewrap.ts - 1 issue
• packages/kilo-sandbox/test/backend.test.ts
• packages/opencode/src/kilocode/sandbox/policy.ts
• packages/opencode/test/kilocode/sandbox/macos-confinement.test.ts
• packages/opencode/test/kilocode/sandbox/policy.test.ts

Previous review (commit 0c237da)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilocode/sandbox/policy.ts	221	Parent policy lookup uses the child directory key, so cross-worktree forks or delegated tasks can miss a stronger stored parent snapshot and fall back to weaker live config.

Fix these issues in Kilo Cloud

Files Reviewed (18 files)

• .changeset/secure-sandbox-config.md
• packages/core/test/kilocode/linux-sandbox.test.ts
• packages/kilo-sandbox/src/bubblewrap.ts
• packages/kilo-sandbox/test/backend.test.ts
• packages/opencode/src/config/variable.ts
• packages/opencode/src/kilocode/config/variable.ts
• packages/opencode/src/kilocode/sandbox/policy.ts - 1 issue
• packages/opencode/src/kilocode/sandbox/store.ts
• packages/opencode/src/session/session.ts
• packages/opencode/src/tool/task.ts
• packages/opencode/test/kilocode/config/variable.test.ts
• packages/opencode/test/kilocode/sandbox/config-network.test.ts
• packages/opencode/test/kilocode/sandbox/macos-confinement.test.ts
• packages/opencode/test/kilocode/sandbox/policy.test.ts
• packages/opencode/test/kilocode/sandbox/session.test.ts
• packages/opencode/test/kilocode/sandbox/shell-network.test.ts
• packages/opencode/test/kilocode/sandbox/state.test.ts
• packages/opencode/test/kilocode/task-nesting.test.ts

---

_{Reviewed by gpt-5.4-20260305 · Input: 67.5K · Output: 10.6K · Cached: 239.4K}

_{Review guidance: REVIEW.md from base branch main}