feat: promote sandbox configuration

[marius-kilocode]

Sandboxing was exposed through experimental configuration fields and an enable switch separated from its dedicated settings page. That made a release-ready security control difficult to discover and left its public config, SDK types, and documentation framed as experimental.

This promotes sandboxing to a first-class sandbox object with enabled, network, and writable_paths settings. It remains disabled by default. Global config defines the baseline; project config may enable sandboxing or deny network access, but cannot weaken global policy or add writable paths. The retired experimental keys are removed rather than migrated.

The VS Code Sandboxing page is visible on supported macOS and Linux hosts, owns the global enable setting, and disables network and writable-path controls until sandboxing is enabled. Windows continues to hide unsupported controls.

The documentation now explains the filesystem and network boundaries, how permissions complement sandboxing, and the prompt-injection, provider-privacy, MCP, plugin, and policy-integrity limits users need when choosing a security setup. Public SDK and OpenAPI config types expose the stable object.

Visual baseline automation now checks out LFS data with a read-only workflow token and uses the Kilo Maintainer App only when a generated baseline commit is required. This replaces the stale PAT path that prevented regeneration.

Companion hosted config-schema update: Kilo-Org/cloud#4462

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Reviewed the incremental change since the last commit: a documentation-only follow-up to sandboxing.md addressing the open reviewer questions from the prior round. Changes: (1) remaining "project" wording switched to "workspace" for consistency, (2) a new table enumerating the concrete $XDG_DATA_HOME/$XDG_CACHE_HOME/$XDG_CONFIG_HOME/$XDG_STATE_HOME/$TMPDIR Kilo runtime paths that are writable inside the sandbox, (3) "Kilo's policy-aware first-party HTTP clients" reworded to name the actual built-in tools (web fetch, web search), (4) the inaccurate "file reads and inbound networking remain allowed" aside removed from the macOS row, and (5) the standalone ## Limitations section removed since its points were already duplicated earlier in the doc (Sandboxing and permissions section).

Verified each rewritten claim against the implementation: Global.Path.{data,cache,config,state,tmp,repos} in packages/core/src/global.ts match the documented XDG paths and the repos/ cache location; the sandbox writable-path list in packages/opencode/src/kilocode/sandbox/policy.ts includes exactly these directories; the webfetch/websearch tools are the ones that flow through the sandbox-aware HttpClient layer (packages/opencode/src/tool/webfetch.ts, websearch.ts, ToolNetwork.httpLayer); and Bubblewrap (packages/kilo-sandbox/src/bubblewrap.ts) silently drops nonexistent writable paths rather than creating them, consistent with "must already exist before Bubblewrap starts." No new bugs, inaccuracies, or style issues found in the changed lines.

The remaining human review comments on sandboxing.md (line 55, plus four now-outdated-position comments at the previous lines 54/101/124/151/155) are open discussion items for the PR author; the ones about the runtime-path list, the HTTP-tool naming, the macOS row wording, and the repeated Limitations section were addressed by this commit.

Files Reviewed (1 file, incremental since last review)

• packages/kilo-docs/pages/getting-started/settings/sandboxing.md

Previous Review Summaries (3 snapshots, latest commit 5697e71)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 5697e71)

Status: No Issues Found | Recommendation: Merge

Reviewed the incremental change since the last commit: a single wording fix in the sandboxing docs ("outside the project" -> "outside the workspace"), addressing a reviewer's open question about accuracy. No new code, logic, or config changes were introduced. The remaining human review comments on sandboxing.md (lines 55, 101, 124, 151, 155) are still open discussion items for the PR author and are unaffected by this change.

Files Reviewed (1 file, incremental since last review)

• packages/kilo-docs/pages/getting-started/settings/sandboxing.md

Previous review (commit 4ebfea8)

Status: No Issues Found | Recommendation: Merge

Reviewed the incremental changes since the last commit: sandboxing is promoted from experimental.sandbox* flags to a first-class sandbox config object (enabled, network, writable_paths) via a new SandboxConfig namespace. Verified the new SandboxConfig.scope merge-time filter: project config can only strengthen policy (enabled: true, network: "deny") and can never weaken a global enabled: true/network: "deny" or add writable_paths — confirmed this against the deep-merge semantics in mergeConfigConcatArrays and the two new config tests ("prevents project config from weakening" / "allows project config to strengthen"). All call sites (SandboxPolicy, task.ts, VS Code webview UI, SDK types, OpenAPI, docs, i18n keys) were updated consistently with the new schema. The SandboxingTab.tsx correctly switched to globalConfig/updateGlobalConfig (an existing pattern already used by IndexingTab.tsx) since sandbox policy is global-only, and added disabled states for network/writable-path controls when sandboxing is off, with matching accessibility spec and unit test updates. The legacy SDK type-patch script and OpenAPI schema changes are internally consistent with the new sandbox object and match the companion hosted config-schema PR referenced in the description.

Files Reviewed (33 files, incremental since last review)

• .changeset/sandbox-settings-page.md
• packages/kilo-docs/pages/getting-started/settings/sandboxing.md
• packages/kilo-vscode/src/shared/sandbox-session.ts
• packages/kilo-vscode/tests/settings-accessibility.spec.ts
• packages/kilo-vscode/tests/unit/new-worktree-dialog-sandbox.test.ts
• packages/kilo-vscode/tests/unit/prompt-input-connection-guard.test.ts
• packages/kilo-vscode/tests/unit/sandboxing-settings.test.ts
• packages/kilo-vscode/webview-ui/agent-manager/NewWorktreeDialog.tsx
• packages/kilo-vscode/webview-ui/src/components/chat/PromptInput.tsx
• packages/kilo-vscode/webview-ui/src/components/settings/SandboxingTab.tsx
• packages/kilo-vscode/webview-ui/src/components/settings/settings-io.ts
• packages/kilo-vscode/webview-ui/src/stories/settings.stories.tsx
• packages/kilo-vscode/webview-ui/src/types/messages/config.ts
• packages/kilo-vscode/webview-ui/src/i18n/*.ts (locale key rename)
• packages/opencode/src/config/config.ts
• packages/opencode/src/kilocode/plugins/sandbox.tsx
• packages/opencode/src/kilocode/sandbox/config.ts (new)
• packages/opencode/src/kilocode/sandbox/policy.ts
• packages/opencode/src/tool/task.ts
• packages/opencode/test/kilocode/config/config.test.ts
• packages/opencode/test/kilocode/sandbox/config-network.test.ts
• packages/opencode/test/kilocode/sandbox/sdk-config.test.ts
• packages/opencode/test/kilocode/sandbox/session-tools.test.ts
• packages/opencode/test/kilocode/sandbox/session.test.ts
• packages/opencode/test/kilocode/sandbox/shell-network.test.ts
• packages/opencode/test/kilocode/sandbox/state.test.ts
• packages/opencode/test/kilocode/sandbox/tui.test.ts
• packages/opencode/test/kilocode/task-nesting.test.ts
• packages/sdk/js/script/build.ts
• packages/sdk/js/src/gen/types.gen.ts
• packages/sdk/js/src/v2/gen/types.gen.ts
• packages/sdk/openapi.json

Previous review (commit cd9229b)

Status: No Issues Found | Recommendation: Merge

Reviewed the platform-gating change (Sandboxing.visible now depends only on sandboxControls, decoupled from experimental.sandbox), the new in-tab Sandbox enable switch with its aria-describedby wiring, the doc rewrite distinguishing filesystem reads/writes and permissions vs. sandboxing, and the visual-regression workflow's move from a static BOT_PAT to a scoped GitHub App token created only when baselines change. Call sites of Sandboxing.visible(), the accessibility spec, and the unit test were all updated consistently with the new single-argument signature, and the CI token/permission changes are internally consistent (contents: read at the workflow level, app token minted only for the commit/push steps).

Files Reviewed (11 files)

• .changeset/sandbox-settings-page.md
• .github/workflows/visual-regression.yml
• packages/kilo-docs/pages/getting-started/settings/index.md
• packages/kilo-docs/pages/getting-started/settings/sandboxing.md
• packages/kilo-docs/public/img/screenshot-tests/kilo-vscode/visual-regression/settings/sandboxing-panel-chromium-linux.png (generated LFS baseline)
• packages/kilo-vscode/tests/settings-accessibility.spec.ts
• packages/kilo-vscode/tests/unit/sandboxing-settings.test.ts
• packages/kilo-vscode/webview-ui/src/components/settings/ExperimentalTab.tsx
• packages/kilo-vscode/webview-ui/src/components/settings/SandboxingTab.tsx
• packages/kilo-vscode/webview-ui/src/components/settings/Settings.tsx
• packages/kilo-vscode/webview-ui/src/components/settings/sandboxing.ts
• packages/kilo-vscode/webview-ui/src/stories/settings.stories.tsx

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 50 · Output: 13.6K · Cached: 1.2M}

_{Review guidance: REVIEW.md from base branch main}

[lambertjosh]

Approved for docs, minor comments