feat(sandbox): add configurable writable paths option

packages/kilo-vscode/webview-ui/src/components/settings/SandboxingTab.tsx

@@ -1,24 +1,51 @@
-import { Component, createMemo } from "solid-js"
+import { Component, For, createMemo, createSignal } from "solid-js"
 import { Card } from "@kilocode/kilo-ui/card"
 import { Switch } from "@kilocode/kilo-ui/switch"
+import { TextField } from "@kilocode/kilo-ui/text-field"
+import { Button } from "@kilocode/kilo-ui/button"
+import { IconButton } from "@kilocode/kilo-ui/icon-button"
 import { useConfig } from "../../context/config"
 import { useLanguage } from "../../context/language"
 import SettingsRow from "./SettingsRow"
 
 const description = "sandbox-network-description"
+const writablePathsDescription = "sandbox-writable-paths-description"
 
 const SandboxingTab: Component = () => {
   const { config, updateConfig } = useConfig()
   const language = useLanguage()
   const experimental = createMemo(() => config().experimental ?? {})
+  const [newPath, setNewPath] = createSignal("")
+
+  const writablePaths = () => experimental().sandbox_writable_paths ?? []
+
+  const addPath = () => {
+    const value = newPath().trim()
+    if (!value) return
+    const current = [...writablePaths()]
+    if (!current.includes(value)) {
+      current.push(value)
+      updateConfig({
+        experimental: { ...experimental(), sandbox_writable_paths: current },
+      })
+    }
+    setNewPath("")
+  }
+
+  const removePath = (index: number) => {
+    const current = [...writablePaths()]
+    current.splice(index, 1)
+    updateConfig({
+      experimental: { ...experimental(), sandbox_writable_paths: current },
+    })
+  }
 
   return (
     <Card>
       <SettingsRow
         title={language.t("settings.sandboxing.network.title")}
         description={language.t("settings.sandboxing.network.description")}
         descriptionId={description}
-        last
       >
         <Switch
           checked={experimental().sandbox_restrict_network !== false}
@@ -36,6 +63,64 @@ const SandboxingTab: Component = () => {
           {language.t("settings.sandboxing.network.title")}
         </Switch>
       </SettingsRow>
+
+      <SettingsRow
+        title={language.t("settings.sandboxing.writablePaths.title")}
+        description={language.t("settings.sandboxing.writablePaths.description")}
+        descriptionId={writablePathsDescription}
+        last
+      >
+        <div style={{ width: "100%" }}>
+          <div
+            style={{
+              display: "flex",
+              gap: "8px",
+              "align-items": "center",
+              padding: "8px 0",
+              "border-bottom": writablePaths().length > 0 ? "1px solid var(--border-weak-base)" : "none",
+            }}
+          >
+            <div style={{ flex: 1 }}>
+              <TextField
+                value={newPath()}
+                placeholder="/tmp"
+                onChange={(val) => setNewPath(val)}
+                onKeyDown={(e: KeyboardEvent) => {
+                  if (e.key === "Enter") addPath()
+                }}
+                hideLabel
+                label={language.t("settings.sandboxing.writablePaths.title")}
+              />
+            </div>
+            <Button variant="secondary" onClick={addPath}>
+              {language.t("common.add")}
+            </Button>
+          </div>
+          <For each={writablePaths()}>
+            {(path, index) => (
+              <div
+                style={{
+                  display: "flex",
+                  "align-items": "center",
+                  "justify-content": "space-between",
+                  padding: "6px 0",
+                  "border-bottom": index() < writablePaths().length - 1 ? "1px solid var(--border-weak-base)" : "none",
+                }}
+              >
+                <span
+                  style={{
+                    "font-family": "var(--vscode-editor-font-family, monospace)",
+                    "font-size": "var(--kilo-font-size-12)",
+                  }}
+                >
+                  {path}
+                </span>
+                <IconButton size="small" variant="ghost" icon="close" onClick={() => removePath(index())} />
+              </div>
+            )}
+          </For>
+        </div>
+      </SettingsRow>
     </Card>
   )
 }

packages/kilo-vscode/webview-ui/src/i18n/de.ts

@@ -1467,6 +1467,10 @@ export const dict = {
   "settings.sandboxing.network.title": "Netzwerkzugriff einschränken",
   "settings.sandboxing.network.description":
     "Blockiert den ausgehenden Netzwerkzugriff für vom Modell initiierte Befehle und HTTP-Tools. Lokale MCP-Server und Plugin-Hooks sind von dieser Einschränkung ausgenommen. Anbieter- und Modellinferenzdatenverkehr bleibt verfügbar.",
+
+  "settings.sandboxing.writablePaths.title": "Zusätzliche schreibbare Pfade",
+  "settings.sandboxing.writablePaths.description":
+    "Zusätzliche Dateisystempfade, in die die Sandbox Schreibvorgänge erlaubt (z. B. /tmp, /var/log). Diese werden mit den Standard-Schreibpfaden zusammengeführt, wenn die Sandbox aktiv ist.",
   "settings.experimental.mcpTimeout.title": "MCP-Zeitlimit (ms)",
   "settings.experimental.mcpTimeout.description": "Zeitlimit für MCP-Server-Anfragen in Millisekunden",
   "settings.experimental.remote.title": "Remote-Steuerung",

packages/kilo-vscode/webview-ui/src/i18n/en.ts

@@ -1422,6 +1422,9 @@ export const dict = {
   "settings.sandboxing.network.title": "Restrict Network Access",
   "settings.sandboxing.network.description":
     "Block outbound network access from model-originated commands and HTTP tools. Local MCP servers and plugin hooks run outside this restriction. Provider and model inference traffic remains available.",
+  "settings.sandboxing.writablePaths.title": "Additional Writable Paths",
+  "settings.sandboxing.writablePaths.description":
+    "Extra filesystem paths the sandbox allows writes to (e.g. /tmp, /var/log). These are merged with the default writable paths when the sandbox is active.",
   "settings.experimental.mcpTimeout.title": "MCP Timeout (ms)",
   "settings.experimental.mcpTimeout.description": "Timeout for MCP server requests in milliseconds",
   "settings.experimental.remote.title": "Remote Control",