fix(cli): keep sandbox disabled by default

[marius-kilocode]

Authless CLI/TUI sessions were being forced into sandbox mode when no KILO_SERVER_PASSWORD was configured, even when experimental.sandbox was absent. That made network-sensitive tools fail by default and diverged from extension-controlled sessions, where sandbox activation is explicit.

This keeps the sandbox default behind the experimental config or per-session toggle while preserving the existing sandbox policy once it is enabled. Network restriction behavior still defaults to deny for enabled sandbox sessions unless experimental.sandbox_restrict_network disables it.

Fixes #11895

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The core change removes the secure() wrapper in policy.ts that previously forced sandboxing on for authless sessions regardless of experimental.sandbox config. The new behavior correctly preserves the safe default network mode (deny) once sandboxing is enabled, matching the PR description. All touched test files consistently add explicit experimental.sandbox: true config where the old forced-default behavior was previously relied upon, and the new/renamed tests accurately reflect the updated semantics. The changeset is user-facing and appropriately worded. All changed files live under kilocode-named paths, so no kilocode_change markers or upstream merge-hygiene concerns apply, and no new config fields were introduced (both sandbox and sandbox_restrict_network already existed in the schema).

Files Reviewed (7 files)

• .changeset/sandbox-default-flag.md
• packages/opencode/src/kilocode/sandbox/policy.ts
• packages/opencode/test/kilocode/sandbox/config-network.test.ts
• packages/opencode/test/kilocode/sandbox/session.test.ts
• packages/opencode/test/kilocode/sandbox/shell-network.test.ts
• packages/opencode/test/kilocode/sandbox/state.test.ts
• packages/opencode/test/kilocode/task-nesting.test.ts

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 26 · Output: 10.2K · Cached: 741.9K}

_{Review guidance: REVIEW.md from base branch main}