fix: explain sandbox escalation prompts accurately

[marius-kilocode]

Why

When the OS sandbox is on and the agent runs a mutating git command, Kilo shows a forced sandbox_escalation prompt. The old title was "Allow Git operation outside the sandbox". Users read this as (a) only git metadata changes and (b) their Bash Allow rule or auto-approve toggle is broken.

Approving the prompt actually runs the entire shell command and its child processes outside the sandbox: filesystem and network restrictions are removed, for that command only. Bash allow rules and auto-approve intentionally never cover this prompt. Git needs it because .git is read-only everywhere in the sandbox, and in a linked worktree the .git file points into the parent repository's .git/ directory, which is outside the sandbox write boundary.

What changed

• Prompt copy (CLI kilo run footer, ACP clients, VS Code permission dock, TUI permission prompt): the title is now "Run outside the sandbox", and the body states the scope, the git reason, and that Bash allow rules and auto-approve never approve it.
• Sandbox toggle tooltip: when the sandbox is on, it now says permission rules and auto-approve apply inside the sandbox, and commands that must leave it always ask.
• Auto-approve toggle tooltip, the kilo-code.new.autoApprove.enabled setting description, and the enable toast: state that sandbox escalation prompts are excluded.
• Docs: new "Leaving the sandbox" section in sandboxing.md with the trigger, the one-shot unrestricted scope, the excluded approvals, and the gh/GitHub allowed-hosts path.

Copy and docs only. No logic changes.

Final prompt copy

Title: Run outside the sandbox? (VS Code) / Run outside the sandbox (CLI, ACP, TUI)

Body:

This runs the whole command with filesystem and network restrictions removed, for this command only. Git must write to .git, which is read-only in the sandbox and outside the worktree in a linked worktree. Bash allow rules and auto-approve never approve this prompt automatically.

Verification

• bun run typecheck and bun run lint in packages/kilo-vscode/
• bun run typecheck in packages/opencode/
• bun test ./test/cli/run/permission.shared.test.ts in packages/opencode/
• bun run test:unit in packages/kilo-vscode/
• bun run script/check-opencode-annotations.ts --worktree
• bun run check-kilocode-change in packages/kilo-vscode/
• bun run script/check-md-table-padding.ts

Manual test

Isolated VS Code dev host on macOS, sandbox enabled in Settings, Code agent, prompt Run this exact command and nothing else: git add -A. The normal shell permission was approved first, then the escalation prompt appeared.

VS Code PermissionDock escalation prompt:

Observed title: Run outside the sandbox?

Observed body: This runs the whole command with filesystem and network restrictions removed, for this command only. Git must write to .git, which is read-only in the sandbox and outside the worktree in a linked worktree. Bash allow rules and auto-approve never approve this prompt automatically.

The command shown was git add -A. The escalation was denied after capture.

Sandbox toggle tooltip (enabled state):

Auto-approve toggle tooltip (disabled state):

The TUI prompt copy is in packages/tui/src/routes/session/permission.tsx and passed typecheck and prettier. It was not exercised interactively in a terminal.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Incremental pass over 2439f503e7d27e075f02673500bbe7838af43ecd..4ff396edf3901054a63d50e60509e684fa994c9d. The delta reverts the quarantined diff-panel scroll test and its baseline back to the main state, so those four paths net to zero against the PR base and are not part of the PR's changed files. No prompt copy, tooltip, docs, locale, CLI/ACP/TUI, or test content changed since the previous pass, so there are no new findings. The locale-copy suggestion on packages/kilo-vscode/webview-ui/src/i18n/en.ts:270 remains open as its own inline comment and is unchanged; it is outside this incremental diff so it is not restated here.

Files Reviewed (4 files)

• packages/kilo-docs/public/img/screenshot-tests/kilo-vscode/visual-regression/agentmanager/diff-panel-with-diffs-chromium-linux.png
• packages/kilo-vscode/tests/diff-scroll-preservation.spec.ts
• packages/kilo-vscode/tests/visual-regression.spec.mts
• packages/kilo-vscode/tests/visual-regression.spec.ts

Previous Review Summaries (7 snapshots, latest commit 2439f50)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 2439f50)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file in this incremental pass)

• packages/tui/src/routes/session/permission.tsx - no issues. The sandbox_escalation prompt now uses the same copy as the CLI kilo run footer and ACP (Run outside the sandbox, the three-line scope/reason/exclusion body), which resolves the previously flagged fourth-surface warning. JSX text collapsing keeps the rendered sentence intact across the wrapped lines, and the kilocode_change markers around the block are intact.

The rest of this PR was reviewed in earlier passes; the delta since 200859fa is this single commit, so the earlier findings (TUI copy, locale translations) are both resolved at HEAD and are not carried forward.

Previous review (commit 200859f)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file in this incremental pass)

• packages/kilo-vscode/tests/diff-scroll-preservation.spec.ts - no issues. The new test.skip(!!process.env["CI"], ...) quarantines the width-change check on CI only, and the referenced agentmanager--diff-panel-scroll-up story is confirmed in the SKIP set in visual-regression.spec.ts for the same nondeterministic scroll offset, so the comment is accurate.

The remainder of the delta between 20698708 and 200859fa is the origin/main merge plus main's own speech-to-text edits (PromptInput.tsx, en.ts), not PR-owned changes. The prior en.ts locale suggestion is resolved at HEAD: every non-English locale now translates notification.permission.titleSandboxEscalation / descriptionSandboxEscalation, so it is not carried forward as an unresolved finding.

Previous review (commit 2069870)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file in this incremental pass)

• .github/actions/setup-linux-sandbox/action.yml - no issues; the Zig download now sets --connect-timeout 15 --max-time 120 and --retry-all-errors, which bounds the transfer to match the commit's stated goal of avoiding the sandbox-helper job timeout. Option usage is valid and the sha256 check still guards integrity.

No source code changed between 71076215 and 20698708; the only new commit tightens the CI download timeouts, so no new Code Review Findings were raised.

Previous review (commit 7107621)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• packages/kilo-vscode/tests/visual-regression.spec.mts
• packages/kilo-vscode/tests/visual-regression.spec.ts
• packages/kilo-vscode/webview-ui/src/i18n/ja.ts
• packages/kilo-vscode/webview-ui/src/i18n/ko.ts
• packages/kilo-vscode/webview-ui/src/i18n/pl.ts
• packages/kilo-vscode/webview-ui/src/i18n/zh.ts
• packages/kilo-vscode/webview-ui/src/i18n/zht.ts

Previous review (commit 97b786a)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/tui/src/routes/session/permission.tsx	359	Carried forward and re-verified at HEAD. This file is not part of the PR diff, so no inline comment can be attached: the interactive TUI still renders Allow Git operation outside the sandbox? together with the old This approval applies to this command only. body. This PR updates the CLI kilo run footer, ACP, and the VS Code dock, but this fourth sandbox-escalation surface keeps the misleading copy the PR set out to fix.

Files Reviewed (1 file in this incremental pass)

• packages/kilo-docs/public/img/screenshot-tests/kilo-vscode/visual-regression/agentmanager/diff-panel-with-diffs-chromium-linux.png - no issues (CI-generated visual regression baseline; intentionally out of review scope)

No source code changed between 27ceab79 and 97b786a; the only new commit refreshes that Git LFS baseline. The earlier locale finding is resolved: all 21 locale files now translate notification.permission.titleSandboxEscalation / descriptionSandboxEscalation, and the old English string no longer appears in any non-English locale.

Fix these issues in Kilo Cloud

Previous review (commit 27ceab7)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/tui/src/routes/session/permission.tsx	359	Still open from the previous review (this file is not part of the PR diff, so no inline comment can be attached): the interactive TUI still renders Allow Git operation outside the sandbox? and the old This approval applies to this command only. body. The new commit translates the VS Code copy into every locale, but the fourth surface that shows the same sandbox-escalation prompt is still unchanged.

Files Reviewed (23 files)

• packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx - no issues (prior suggestion on the split-out key resolved)
• packages/kilo-vscode/webview-ui/src/components/shared/SandboxButton.tsx - no issues
• packages/kilo-vscode/webview-ui/src/i18n/*.ts (21 locale files) - no issues; new prompt.action.autoApprove.sandboxExcluded and prompt.action.sandbox.description.escalation keys present exactly once in all 21 files, notification.permission.titleSandboxEscalation / descriptionSandboxEscalation fully translated, no English leftovers
• packages/tui/src/routes/session/permission.tsx (unchanged; verified at HEAD) - 1 issue

Fix these issues in Kilo Cloud

Previous review (commit 9f45df5)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/tui/src/routes/session/permission.tsx	359	The interactive TUI permission prompt still renders the old copy (Allow Git operation outside the sandbox? / This approval applies to this command only.). This file is not part of the PR diff, so no inline comment could be placed there. The PR updates the CLI kilo run footer, ACP, and the VS Code dock, but misses this fourth surface that shows the same sandbox escalation prompt.

SUGGESTION

File	Line	Issue
packages/kilo-vscode/webview-ui/src/i18n/en.ts	270	Changed English copy was not propagated to non-English locales, and the new notification.permission.descriptionSandboxEscalation string is English in all 20 locale files.

Files Reviewed (30 files)

• .changeset/sandbox-escalation-prompt-copy.md - no issues
• packages/kilo-docs/pages/getting-started/settings/sandboxing.md - no issues
• packages/kilo-vscode/package.json - no issues
• packages/kilo-vscode/src/commands/toggle-auto-approve.ts - no issues
• packages/kilo-vscode/tests/unit/auto-approve.test.ts - no issues
• packages/kilo-vscode/webview-ui/src/components/chat/PermissionDock.tsx - no issues
• packages/kilo-vscode/webview-ui/src/i18n/*.ts (21 locale files) - 1 issue
• packages/opencode/src/acp/permission.ts - no issues
• packages/opencode/src/cli/cmd/run/permission.shared.ts - no issues
• packages/opencode/test/cli/run/permission.shared.test.ts - no issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}