chore: convert upstream-manual-merge command to agent

[kilo-code-bot]

Summary

Converts .kilo/command/upstream-manual-merge.md into .kilo/agent/upstream-merge.md so the workflow can run under agent-scoped permissions. The body of the workflow is unchanged except for step 1, which no longer relies on $ARGUMENTS (agents don't support command template vars) — the agent reads the version from the user's first message, the branch name, or the newest upstream-merge-report-<version>.md.

Why

The existing slash command ran under the caller's unrestricted permissions. As an agent we can gate read, edit, and webfetch behind ask, and whitelist only the read-only shell commands the workflow actually needs (git status/log/diff/show, grep/rg, cat/head/tail, gh pr view, script/upstream/find-conflict-markers.sh, the project's test/typecheck/lint runners, etc.) while leaving everything else — notably sed -i and any other file-mutating shell command — to fall through to ask. This makes the "approve before applying" step of the manual merge workflow mechanical instead of social.

Notes

• Permission rules use last-match-wins (permission/evaluate.ts:9-15 uses Array.findLast), so "*": ask is listed first and specific allows follow. The kilo-config built-in skill doc currently states the opposite — worth a follow-up fix there.
• Bash patterns match against the full literal command string (anchored both ends); a trailing * is special-cased so e.g. "git status *" matches both bare git status and git status --short.

[kilo-code-bot]

WARNING: echo * still permits file-mutating shell commands

Because bash permission patterns match the full command string, this allow rule also matches commands like echo data > file or echo data >> file. That lets the agent modify repository files without an edit approval, which bypasses the stated goal that file-mutating shell commands fall through to ask.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• .kilo/agent/upstream-merge.md

---

_{Reviewed by gpt-5.5-20260423 · 302,393 tokens}

[markijbema]

Superseded by #9965.