fix(cli): block project markdown secret exfiltration

[marius-kilocode]

Markdown-backed configuration is converted directly into model-visible prompts for project agents, commands, modes, workflows, instructions, and skills. Until now, KilocodeMarkdown.substitute expanded {env:VAR} and {file:path} without knowing whether the Markdown came from user-controlled global configuration or an untrusted repository.

A malicious repository could therefore commit Markdown such as {file:~/.aws/credentials} or {env:AWS_SECRET_ACCESS_KEY} under .kilo or another discovered project configuration directory. Loading that Markdown copied the local secret into the resulting prompt. When the prompt was sent to a model, particularly through a provider configuration using an attacker-controlled baseURL, the repository could exfiltrate credentials or arbitrary readable files without requiring a normal file-read tool call or permission prompt.

#11886 introduced the trust boundary for JSON configuration values, but intentionally left the parallel Markdown substitution path for #11889. This change completes that boundary across every Markdown-backed configuration loader.

The durable behavior is:

• Project Markdown rejects active {env:...} references because environment variables have no safe project-scoped form.
• Project {file:...} references are allowed only when the canonical target remains inside the active project root.
• Markdown source files are guarded as well as substituted file references, preventing a repository from replacing an agent, command, workflow, instruction, or skill file with a symlink to a secret outside the project.
• File reads reuse the existing descriptor-pinned, realpath-based ConfigVariableGuard, preserving its traversal, symlink, inode-swap, and /proc/*/environ protections.
• Trust provenance is retained while configuration sources are merged. A project cannot select an external instruction or skill directory and thereby upgrade it to trusted, and a trusted relative declaration that resolves into project content does not make that project content trusted.
• Primary-checkout fallback Markdown may be discovered from the primary checkout, but its {file:...} substitutions remain confined to the active project boundary.
• Rejected project workflow files are skipped individually, so an unsafe project workflow cannot suppress a valid sibling or same-named trusted global workflow.
• Explicitly trusted global, KILO_CONFIG, KILO_CONFIG_CONTENT, organization, MDM, and KILO_CONFIG_DIR sources preserve their existing file and environment substitution behavior.

The trust and scope signal is threaded through agent, command, mode, workflow, instruction, skill, settings-overlay, and validation paths, with runtime-only provenance removed before configuration is persisted or exposed for editing.

Fixes #11889

Follow-up to #11886.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• packages/opencode/src/session/instruction.ts
• packages/opencode/test/kilocode/session/instruction-substitution.test.ts

Previous Review Summary (commit 7a32383)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 7a32383)

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/session/instruction.ts	173	Trusted relative global instructions are downgraded and omitted when project config is disabled.

Files Reviewed (19 files)

• .changeset/guard-markdown-substitutions.md - 0 issues
• packages/opencode/src/config/agent.ts - 0 issues
• packages/opencode/src/config/command.ts - 0 issues
• packages/opencode/src/config/config.ts - 0 issues
• packages/opencode/src/config/markdown.ts - 0 issues
• packages/opencode/src/kilocode/config-validation.ts - 0 issues
• packages/opencode/src/kilocode/config/markdown.ts - 0 issues
• packages/opencode/src/kilocode/config/overlay.ts - 0 issues
• packages/opencode/src/kilocode/session/instruction.ts - 0 issues
• packages/opencode/src/kilocode/tui/config.ts - 0 issues
• packages/opencode/src/kilocode/workflows-migrator.ts - 0 issues
• packages/opencode/src/session/instruction.ts - 1 issue
• packages/opencode/src/skill/index.ts - 0 issues
• packages/opencode/test/config/markdown.test.ts - 0 issues
• packages/opencode/test/kilocode/config-resilience.test.ts - 0 issues
• packages/opencode/test/kilocode/config/config.test.ts - 0 issues
• packages/opencode/test/kilocode/config/markdown.test.ts - 0 issues
• packages/opencode/test/kilocode/session/instruction-substitution.test.ts - 0 issues
• packages/opencode/test/kilocode/workflows-migrator.test.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by gpt-5.6-sol · Input: 56.4K · Output: 5.6K · Cached: 391.7K}

_{Review guidance: REVIEW.md from base branch main}