feat(cli): protect CLI config files from silent edits - #7573
Merged
Conversation
Add ConfigProtection namespace with utilities to detect when a permission request targets CLI config files. This covers: - Project-relative paths (.kilo/, .kilocode/, .opencode/ dirs, kilo.json, AGENTS.md) - Absolute paths (~/.config/kilo/, ~/.kilo/, ~/.kilocode/) - Multi-file requests from apply_patch (metadata.files[], comma-joined filepath)
Override 'allow' to 'ask' in the permission engine when editing config files. Sets disableAlways metadata flag for UI clients. Safety nets prevent persistent rule creation for config paths: - reply() downgrades 'always' to 'once' (no rules saved) - saveAlwaysRules() skips entirely for config requests - drainCovered() never auto-resolves config file permissions
When the disableAlways metadata flag is set on a permission request, only show 'Allow once' and 'Reject' options in the TUI prompt.
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Fix these issues in Kilo Cloud Other Observations (not in diff)Issues found in unchanged code that cannot receive inline comments:
Previous warnings on Files Reviewed (5 files)
Reviewed by gpt-5.4-20260305 · 1,632,850 tokens |
…onstant - Check absolute patterns in isRequest via isAbsolute() to match the existing metadata.filepath dual-dispatch logic, preventing a bypass where tools pass absolute project-level config paths in patterns - Export ConfigProtection.DISABLE_ALWAYS_KEY constant to replace the 'disableAlways' magic string across config-paths.ts, next.ts, and permission.tsx so renames/typos are caught at compile time
… access Plan files (.kilo/plans/*.md) were incorrectly flagged as config files by isRelative(), causing permission prompts for the plan agent. Add EXCLUDED_SUBDIRS to skip non-config subdirectories under config dirs. Extend isRequest() to also check external_directory permissions against global config paths (~/.config/kilo/), preventing 'Always allow' from granting permanent directory access to config directories.
alex-alecu
changed the title
jeanduplessis
approved these changes
Mar 27, 2026
jliounis
pushed a commit
to jliounis/kilocode
that referenced
this pull request
May 18, 2026
…-protection feat(cli): protect CLI config files from silent edits
t7tran
pushed a commit
to t7tran/kilocode
that referenced
this pull request
Aug 14, 2026
…-protection feat(cli): protect CLI config files from silent edits
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Followup to #7444
Why
When a user selects "Always allow" for file edits, the AI agent can silently modify CLI config files (like permission rules, agent settings, or project config) without the user noticing. This is a security risk because config changes can alter how the tool behaves going forward.
What changed
The permission system now detects when an edit targets a config file and forces the user to approve it every time, even if they previously chose "Always allow" for edits. Config files include project-level directories like
.kilo/,.kilocode/,.opencode/, root config files likekilo.jsonandAGENTS.md, and global config directories like~/.config/kilo/. When a config edit is detected, the "Always allow" button is hidden in the TUI and the backend prevents any client from saving persistent allow-rules for these paths.The
kilo run --automode still works — edits go through but no permanent rules get saved.Plan files exempt from config protection
Non-config subdirectories under
.kilo/(specifically.kilo/plans/) are excluded from config protection viaEXCLUDED_SUBDIRS. The plan agent writes plan files to.kilo/plans/*.mdusing theeditpermission, and these were previously caught byisRelative()because it matched any path starting with.kilo/. Plan files are not config files, so they now pass through without a permission prompt.Demo
When asking CLI to edit global config:
When asking CLI to edit local repo config:
Global config directory protected for
external_directoryaccessConfigProtection.isRequest()previously only checkededitpermissions. Theexternal_directorypermission (triggered when accessing paths outside the project, like~/.config/kilo/) was not covered, meaning "Always allow" could grant permanent directory access to global config directories.isRequest()now also handlesexternal_directorypermissions by checking absolute patterns against known config dirs (Global.Path.config,KilocodePaths.globalDirs()).How to test
.kilo/command/test.mdsrc/index.ts.kilo/plans/without a permission prompt~/.config/kilo/— verify only "Allow once" and "Reject" are shown (no "Allow always")