feat(sandbox): add configurable writable paths option

[trim21]

Add experimental.sandbox_writable_paths config option that allows users to specify additional filesystem paths the sandbox permits writes to (e.g. /tmp, /var/log, ~/.cache). These paths are merged with the default writable paths when the sandbox is active.

Changes

CLI (packages/opencode/)

• src/config/config.ts — new experimental.sandbox_writable_paths field (string[])
• src/kilocode/sandbox/policy.ts — profile() accepts extra writable paths, execute() reads from config

VS Code (packages/kilo-vscode/)

• webview-ui/src/types/messages/config.ts — added sandbox_writable_paths to ExperimentalConfig
• webview-ui/src/i18n/en.ts — i18n keys for the new setting
• webview-ui/src/components/settings/SandboxingTab.tsx — list input UI (add/remove paths)

Usage

{
  "experimental": {
    "sandbox": true,
    "sandbox_writable_paths": ["/tmp", "/var/log"]
  }
}

[kilo-code-bot]

Code Review Summary

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/config/config.ts	766	New local-scope guard sets sandbox_writable_paths: undefined on an own property rather than omitting the key; since global config merges before project config via remeda's mergeDeep (which copies source[key] even when undefined), a project file that also declares this key can wipe out a legitimately-set global value instead of just having its own override ignored
packages/kilo-vscode/webview-ui/src/components/settings/SandboxingTab.tsx	84	New writable-paths TextField isn't wired via aria-describedby to its SettingsRow description, unlike the Switch right above it

SUGGESTION

File	Line	Issue
packages/opencode/src/kilocode/sandbox/policy.ts	309	No test coverage added for the new extraWritable/sandbox_writable_paths behavior
packages/opencode/src/config/config.ts	421	New kilocode_change config field should be mirrored to the cloud JSON Schema (apps/web/src/app/config.json/extras.ts); CI doesn't check this

Resolved since last review: the ~ in sandbox_writable_paths is now correctly expanded to the home directory in execute() (packages/opencode/src/kilocode/sandbox/policy.ts) before being passed into profile().

Files Reviewed (2 files)

• packages/opencode/src/config/config.ts - 2 issues
• packages/opencode/src/kilocode/sandbox/policy.ts - 1 issue (fixed: ~ expansion)

Fix these issues in Kilo Cloud

Previous Review Summary (commit 889e2f4)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 889e2f4)

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/config/config.ts	766	New local-scope guard sets sandbox_writable_paths: undefined on an own property rather than omitting the key; since global config merges before project config via remeda's mergeDeep (which copies source[key] even when undefined), a project file that also declares this key can wipe out a legitimately-set global value instead of just having its own override ignored
packages/kilo-vscode/webview-ui/src/components/settings/SandboxingTab.tsx	84	New writable-paths TextField isn't wired via aria-describedby to its SettingsRow description, unlike the Switch right above it

SUGGESTION

File	Line	Issue
packages/opencode/src/kilocode/sandbox/policy.ts	309	No test coverage added for the new extraWritable/sandbox_writable_paths behavior
packages/opencode/src/config/config.ts	421	New kilocode_change config field should be mirrored to the cloud JSON Schema (apps/web/src/app/config.json/extras.ts); CI doesn't check this

Resolved since last review: the ~ in sandbox_writable_paths is now correctly expanded to the home directory in execute() (packages/opencode/src/kilocode/sandbox/policy.ts) before being passed into profile().

Files Reviewed (2 files)

• packages/opencode/src/config/config.ts - 2 issues
• packages/opencode/src/kilocode/sandbox/policy.ts - 1 issue (fixed: ~ expansion)

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 32 · Output: 10.3K · Cached: 832K}

_{Review guidance: REVIEW.md from base branch main}

[marius-kilocode]

Hi @trim21 very cool! We wanted to add this (including a similar pattern for the network sandbox) anyway. We should fix the ~ bot comment and the project config escalation. Users should not be able to bypass the config, otherwise they can configure the sandbox escapable.

---

1. ~ expansion — resolved without a fix

Last commit (889e2f43) predates the bot review; the warning was resolved with no fix. path.resolve("~/.cache") → <cwd>/~/.cache, but ~/.cache is still advertised in the PR body, the /tmp placeholder, and all 21 i18n descriptions.

Fix: expand leading ~ to os.homedir() in execute() before passing to profile(), or drop ~ from all docs/UI if it's not supported.

2. Project-config escalation — needs a decision

Project kilo.json merges into config, so a repo can ship "sandbox_writable_paths": ["/"] and widen its own sandbox even when the user explicitly enabled it. The sandbox's threat model is model-originated commands in that repo. Deny rules (.git, SandboxStore, SandboxPreference) still win, but everything else becomes writable.

Fix (preferred): honor sandbox_writable_paths from global config only — strip it from the project-scoped overlay at config-read time. If project-scoped is intended, surface it as a confirmation prompt on first sandbox enable in that directory.

[trim21]

ignore sandbox_writable_paths from workspace make sence as a sandbox config

[marius-kilocode]

I tested this, works great. The input field is a bit small for most paths don't you think? And it doesn't have any tests currently. But I will merge anyway and we can iterate later. Thanks for that!