{"as_of":{"date":"2026-10-27","scope":"Public docs, registry/release metadata and v7.8.18 source. Templates/designs and verification checklist are unexecuted proposals. Source IDs resolve to direct URLs in sources. This item assigns no comparative rank."},"runtime_version":{"name":"Kilo CLI","verified":{"text":"GitHub latest and npm dist-tags.latest identify v7.8.18 / @kilocode/cli 7.8.18. GitHub published_at=2026-10-26T09:05:47Z; npm time[\"7.8.18\"]=2026-10-26T09:08:49.601Z. Release commit: b817615.","sources":["release","latest","npm"]},"license":{"text":"MIT, in both tagged repository LICENSE and npm version metadata. npm exposes kilo and kilocode executables and platform-specific optional binary packages pinned to 7.8.18.","sources":["license","npm"]},"pinning":{"text":"Image-build provisioning command: npm install -g @kilocode/cli@7.8.18; verify kilo --version. Adapter proposal: pin image digest and archive selected platform binaries/dependencies for offline reproduction.","sources":["npm","cli_doc"],"status":"source-backed command; image handling proposed"},"stable_boundary":{"text":"Sandbox config/backends, usage schema and permission-aware --auto exist at this tag; CLI depends on @kilocode/sandbox. Binary/backend enforcement remains untested. No newer main behavior is assumed.","sources":["sandbox_config","sandbox_policy","bwrap","seatbelt","package","run","usage_schema"]}},"invocation":{"recipe_status":"Source-backed v7.8.18 template, unexecuted; ${...} parameters are deployer-supplied.","parameters":{"KILO_BIN":"Verified 7.8.18 binary absolute path","WORKDIR":"Isolated checkout root absolute path","PROVIDER_ID/MODEL_ID":"Configured provider/available model; never guessed","RUN_TITLE":"Explicit non-default title","WRITE_GLOB":"Assigned workspace-relative output pattern","SESSION_ID":"Root ID from JSONL","inputs_outputs":"PROMPT_TEXT: single argv string; PROMPT_FILE: finite UTF-8 stdin file; ATTACHMENT_PATH: optional existing context file; EVENTS_FILE/STDERR_FILE: supervisor-owned captures outside model-writable mounts"},"argv_template":{"executable":"${KILO_BIN}","argv":["run","--dir","${WORKDIR}","--model","${PROVIDER_ID}/${MODEL_ID}","--agent","build","--format","json","--title","${RUN_TITLE}","--","${PROMPT_TEXT}"],"stdin":"closed /dev/null","stdout":"${EVENTS_FILE}","stderr":"${STDERR_FILE}","sources":["run","agent"]},"prompt_file_variant":{"executable":"${KILO_BIN}","argv":["run","--dir","${WORKDIR}","--model","${PROVIDER_ID}/${MODEL_ID}","--agent","build","--format","json","--title","${RUN_TITLE}"],"stdin":"Open ${PROMPT_FILE} as a finite stream; close at EOF. Do not add --file merely to mean prompt-file input.","sources":["run","run_input"]},"attachment_variant":{"text":"For context add --file ${ATTACHMENT_PATH} before --, retaining a prompt. --file/-f is an array option. Local relative paths resolve after --dir; files become file: URLs with text/plain, directories application/x-directory. Content may enter model context. Construct argv directly, avoiding shell interpolation.","sources":["run","prompt"]},"environment_template":{"KILO_NO_DAEMON":"1","KILO_DISABLE_PROJECT_CONFIG":"1","KILO_DISABLE_AUTOUPDATE":"1","KILO_PURE":"1","KILO_DISABLE_CLAUDE_CODE":"1","KILO_EXPERIMENTAL_BACKGROUND_SUBAGENTS":"false","sources":["daemon","flags","runtime_flags","config","plugin","instruction","global"],"adapter_setup":"Adapter: clean environment, dedicated OS home and XDG data/cache/config/state; only selected provider credentials. Reviewed policy at XDG_CONFIG_HOME/kilo/kilo.jsonc. KILO_PURE suppresses external server plugins, preserving built-in auth integrations. Inspect effective config; flags are not OS confinement."},"fresh_session":{"text":"Omit resume/fork/attach/share/interactive options: ordinary run creates a new session when none selected. KILO_NO_DAEMON=1 prevents opportunistic daemon attachment. Fresh state avoids saved approvals/sandbox preferences.","sources":["run","daemon","sandbox_policy"]},"completion":{"text":"run submits one prompt and waits for capability-checked session draining and a matching session.drained token. Interruption, premature stream termination or unsupported servers fail. It has no overall timeout/token/dollar option; finite-turn interface does not guarantee execution terminates.","sources":["run","drain"]},"approval":{"text":"Omit --auto: allows execute; received asks are rejected, with ordinary auto-rejections failing the run. Headless session denies question/suggest/plan_enter/plan_exit. --auto replies once to tracked root/task-child asks; server rejects explicit denies before queuing asks. Skill-shell/sandbox-escalation asks are rejected even with --auto. Avoid hidden --yolo/--dangerously-skip-permissions.","sources":["run","permissions","run_auto"]},"auth_prerequisite":[{"text":"Provision first via interactive kilo /connect or kilo auth login --provider ${PROVIDER_ID}. --method selects an available label, not exemption from consent/key entry. API/OAuth credentials persist at the selected data root/auth.json; inject only reviewed job-scoped credentials/config.","sources":["cli_doc","cli_ref","auth","global"]},{"text":"Tagged loaders support Kilo, OpenRouter, OpenAI, Anthropic, Gemini/Vertex, Bedrock, Azure, OpenAI-compatible endpoints, xAI, Mistral, Groq, Cerebras, DeepInfra, Cohere, TogetherAI, Perplexity, Alibaba, GitLab, GitHub Copilot, Venice and gateways (nonexhaustive implementation list, not connectivity/entitlement proof). Discover with kilo models ${PROVIDER_ID}.","sources":["providers","cli_ref"]},{"text":"Subscription OAuth: kilo auth login --provider codex (or openai) uses ChatGPT plans for supported Codex models, taking priority over API config. Copilot implements OAuth device login. Kilo login and Gateway BYOK authorization are separate. Pre-complete consent; handle refresh/revocation/quota errors without interactive fallback. No account/model entitlement is assumed.","sources":["chatgpt","copilot"]}],"exit_error_timeout_handling":[{"text":"run.ts uses exit 1 for validation failures, prompt/execution/drain/root-session errors, ordinary auto-rejected asks and no assistant output. Tool failures emit tool_use with state.status=error but do not inherently force nonzero. Root success is not all-children success.","sources":["run"]},{"text":"Adapter: separately retain raw JSONL/stderr/OS status; inspect error events and tool states, require root ID/process completion and artifact acceptance. Nonzero, signal, timeout or truncated output means failed/indeterminate; retain partial usage/files. Distinguish recovered tool failures from unmet requirements; do not blindly retry timed-out work.","sources":["run","drain"],"status":"adapter design"},{"text":"Adapter supervisor enforces ${WALL_TIMEOUT}/${KILL_GRACE}, then kills the entire container/cgroup/VM, classifying timeout itself. run retries session.network.asked at most 3 consecutive times (busy resets counter), not a global limit. Provider timeout/headerTimeout/chunkTimeout bound provider traffic, not the job.","sources":["run","provider_schema"],"status":"adapter design plus tagged limitations"}]},"confinement":{"built_in":[{"text":"Opt-in tool sandbox, disabled by default; not whole-process isolation. Linux uses bwrap, macOS Seatbelt; Windows unsupported. Failure to establish an enabled boundary rejects affected tools. Reads remain as broad as OS-account access. Provider inference, plugin hooks, MCP startup/reconnection and MCP prompt retrieval are outside this tool network boundary.","sources":["sandbox_doc"]},{"text":"Policy permits workspace/worktree and Kilo data/cache/state/tmp/runtime writes plus writable_paths; protects .git, sandbox policy/preferences and global config. Linked worktrees avoid widening to the parent checkout. Policy-aware mutations and shell descendants are covered; host-readable files remain visible and main-process access is not confined.","sources":["sandbox_policy","bwrap","seatbelt"]},{"text":"network=deny with empty allowed_hosts blocks tool sockets while model traffic remains outside. Optional global allowed_hosts accepts exact public DNS host[:port], default 443, not URLs/IPs/wildcards/CIDR. Authenticated HTTP(S) proxy checks destination/SNI, not account/path/data loss. Minimal policy leaves it empty.","sources":["sandbox_config","sandbox_doc","bwrap"]},{"text":"Project sandbox config may tighten enabled/network, never add hosts/write paths or weaken global policy. Saved session/directory enabled choices precede config defaults: use fresh state and verify effective status, especially on resume.","sources":["sandbox_config","sandbox_policy"]},{"text":"Restricted tools reject opaque/custom network tools and MCP invocations; notebook/background host execution is separately blocked. Plugin hooks and MCP lifecycle precede/exceed tool gates. Clean MCP/plugin config plus suppressed repository config are required; built-in auth still executes in the CLI host process.","sources":["sandbox_network","sandbox_network_tools","plugin","prompt","config","permissions"]},{"text":"Child/fork confinement combines enabled strictly, deny-all wins and constrained host/write lists intersect. Later trusted policy refresh can replace limits. This remains tool confinement, not worktree/process isolation.","sources":["sandbox_policy"]},{"text":"Escalation can run an entire command/descendants unrestricted. Server requires interactive=true for approval and headless run rejects these asks. Never impersonate human approvals; this recipe forbids escalation.","sources":["permissions","run"]}],"outer_isolation_proposal":{"status":"Untested deployment design, not a Kilo capability or claimed execution result.","process_boundary":"Run the entire CLI/integrations/descendants inside a dedicated unprivileged container or disposable VM. Mount sanitized checkout/assigned outputs writable, toolchain read-only, dedicated Kilo state/cache/tmp writable and reviewed config read-only after initialization. Exclude host home, SSH/Docker sockets, host IPC and unrelated credentials. Enforce capability/privilege, CPU/memory/PID/disk/time limits. If nested bwrap cannot be supported safely, use a VM; never grant broad host privilege merely for inner sandboxing.","egress_route":"Online model route: outer firewall permits only ${INFERENCE_RELAY_HOST}:${INFERENCE_RELAY_PORT}; trusted relay forwards authorized ${PROVIDER_ID}/${MODEL_ID} requests to the selected provider. Deny other egress/inbound, metadata/private destinations and cross-worker traffic; use controlled DNS. A localhost relay must share the namespace; an external relay needs an explicitly reachable restricted address. Enforce routing outside the worker. Whole-process network=none is incompatible with this online recipe.","provider_integration":"Where compatible, set provider[${PROVIDER_ID}].options.baseURL=${INFERENCE_RELAY_URL}. Schema supports baseURL, but protocol/OAuth compatibility is provider-specific and untested. Fixed/multiple provider hosts need a controlled transparent gateway or enumerated external allowlist; do not assume plugins honor baseURL/HTTP_PROXY. Pre-provision OAuth; permit narrowly scoped refresh through the gateway if needed. Keep inner tool network=deny/allowed_hosts=[]. CONNECT-only filtering cannot enforce request model/account/path or authoritative usage.","metering_route":"Relay admits job credentials, records raw request IDs/usage for every attempt and auxiliary call, bounds concurrency/output/retries, and revokes access on deadline/budget exhaustion. Prefer upstream secrets at relay. Native OAuth may require worker-held scoped credentials readable by same-process integrations. Local inference needs an explicit local-service route or model inside the boundary; offline inference can avoid online egress.","evidence_for_need":["sandbox_doc","sandbox_policy","plugin","auth","provider_schema"]}},"metering":{"capture":{"text":"--format json emits JSONL {type,timestamp:Date.now(),sessionID,...payload}; step_finish has part.type=step-finish. run filters parts to the root ID despite tracking child approvals: not all-session SSE. Reconcile with kilo export ${SESSION_ID} in the same directory/state; explicit ID avoids picker. Export shape is {info,messages:[{info,parts}]}, not a recursive child export.","sources":["run","export"]},"field_schema":{"record":"{type:\"step_finish\",timestamp:number,sessionID:string,part:{id:string,sessionID:string,messageID:string,type:\"step-finish\",reason:string,cost:number,tokens:{total?:number,input:number,output:number,reasoning:number,cache:{read:number,write:number}},model?:{providerID:string,modelID:string},generationID?:string,vercelID?:string,time?:{start:number,end:number,elapsed:number},metrics?:{prompt?:number,generation?:number,source:\"provider\"|\"computed\"}}}","sources":["run","usage_schema","processor"],"notes":"Optional fields stay unknown/absent. time.elapsed is active model-generation milliseconds, not wall time. generationID/vercelID are optional metadata, not universal billing IDs; no universal request-ID or missing-usage flag."},"semantics":[{"text":"step-finish holds one model step usage/cost. Processor overwrites assistantMessage.tokens with latest-step usage but adds usage.cost; child reconciliation can increase message cost. Do not interpret assistant tokens as cumulative or add message cost to step costs. SessionInfo optional cost/tokens are aggregates without tokens.total, not another additive ledger.","sources":["processor","session","usage_schema","cost_propagation"]},{"text":"Normalization: input=max(0,inputTokens-cacheReadInputTokens-cacheWriteInputTokens); output=max(0,outputTokens-reasoningTokens). reasoning/cache.read/cache.write are separate. Cache-write metadata fallbacks include Anthropic/Vertex/Bedrock/Venice. total is optional SDK-reported total, not recomputed. Missing/nonfinite components normalize to zero: zero cannot prove no billed use. Preserve raw relay usage.","sources":["session"]},{"text":"Adapter: upsert final parts by (sessionID,messageID,part.id), sum each once. Component sum=input+cache.read+cache.write+output+reasoning; label separately from optional provider total, never add both. Duplicate updates/export replace the same key. Retries without persisted completion require relay records and may be billed.","sources":["processor","usage_schema","session"],"status":"adapter algorithm"},{"text":"Task metadata sessionId and session parentID identify descendants. Export each or capture all-session SDK events; root JSON misses child tokens. Sum unique step parts across the graph. Child costs propagate recursively into parent messages, including resume deltas; summing both double-counts. Validate child/drain completeness for foreground/background execution.","sources":["run","run_auto","task","cost_propagation","processor","export"]},{"text":"Auxiliary gap: ensureTitle uses a separate small-model stream, consumes text deltas and does not persist ordinary processor step usage. Explicit non-default --title suppresses it. Set compaction.auto=false; if summaries/compaction or model integrations are enabled, meter their relay requests separately. Root step usage is not all account usage.","sources":["prompt","config_schema","processor","run"]},{"text":"Resume/fork adapter: snapshot existing IDs/final values and count new attributable parts only. Fork code zeros copied assistant/step costs while preserving history; old exported tokens are not fresh spend. Do not infer invocation usage from transcript totals, timestamps alone or fork zero cost.","sources":["session","export","run"]},{"text":"On kill/broken stream/missing usage, mark coverage incomplete. Export recovers persisted parts, not necessarily in-flight/retried/auxiliary calls. Reconcile relay/provider records. Adapter ledger records job/version, session/message/part IDs, selected/actual model, request IDs if present, OS termination and coverage; never equate normalized zeros with missing-usage proof.","sources":["session","processor","usage_schema","drain"],"status":"adapter handling of source limitations"}],"cost_and_budgets":[{"text":"cost first uses providerCost metadata (OpenRouter/Kilo/upstream/Gateway market cost), else model per-million input/output/cache pricing, with reasoning at output price, tiers and Copilot-specific conversion. Missing prices can yield zero. It is not an invoice or subscription quota meter; retain price provenance and reconcile provider billing.","sources":["session","provider_cost"]},{"text":"No run-wide hard token/dollar/deadline option. agent.steps inserts MAX_STEPS_PROMPT in the loop, not spend reservation; provider timeouts bound requests only. Post-step usage arrives after spend, so parallel/in-flight work can overshoot. Proposed relay admission reserves conservatively and caps output/concurrency/retries; stop new calls at threshold/deadline and report uncertainty.","sources":["run","agent_schema","prompt","provider_schema"],"status":"source limitation and adapter proposal"}]},"tool_policy":{"minimal_policy_template":{"share":"disabled","plugin":[],"mcp":{},"instructions":[],"compaction":{"auto":false},"sandbox":{"enabled":true,"network":"deny","allowed_hosts":[],"writable_paths":[]},"permission":{"*":"deny","read":{"*":"allow","*.env":"deny","*.env.*":"deny","*.env.example":"allow"},"glob":"allow","grep":"allow","edit":{"*":"deny","${WRITE_GLOB}":"allow",".git/*":"deny",".kilo/*":"deny",".kilocode/*":"deny","kilo.json*":"deny","opencode.json*":"deny","AGENTS.md":"deny"},"bash":"deny","external_directory":"deny","task":"deny","agent_manager":"deny","skill":"deny","webfetch":"deny","websearch":"deny","lsp":"deny"}},"template_sources":["config_schema","permission_schema","permissions","permissions_doc","sandbox_config","write","patch"],"installation":"Substitute ${WRITE_GLOB} with assigned relative output pattern; install at isolated global kilo.jsonc. Protect config from model writes. Hard write scoping requires outer mounts, not just this template.","interpretation":[{"text":"Ordered global *=deny precedes explicit read/glob/grep and selected edit allows; unknown/new tools inherit deny. Shell/external/task/agent-manager/skill/web/LSP remain denied. write/apply_patch check edit. Delegation is disabled; run tests through a separate trusted adapter stage initially.","sources":["permission_schema","permissions","write","patch"]},{"text":"Within a ruleset the last matching tool/target rule wins: broad fallback first, exceptions and sensitive denies later. This is not universal deny-overrides. resolve preserves base deny against saved/session allows; --auto answers queued asks rather than replacing base rules, so deny survives it. Later project/agent/config rules must not change the base.","sources":["permissions_doc","permissions","run","agent","config"]},{"text":"Allows need no --auto. With --auto, ask becomes automatic approval. cli.md claims only preapproved operations run, questions get canned answers and tasks time out; source instead replies once to tracked asks, denies headless question tools and has no job deadline. Use explicit deny/external timeout.","sources":["cli_doc","run","permissions"]},{"text":"read/edit paths are worktree-relative. glob/grep permissions match search patterns, not read ACLs; external_directory/OS isolation are separate. .env rules cannot stop grep/shell/integrations reading secrets via other paths. Remove secrets. Enabled shell checks each parsed command, not kernel effects.","sources":["permissions_doc","grep","glob","sandbox_doc"]},{"text":"Global/project/agent merges can alter policy; later agent rules override earlier defaults. Disable project discovery; fresh home/config and resolved-policy inspection are required. Empty plugin/MCP values in inherited merged config do not prove absence; KILO_PURE suppresses external plugins. Tool deny does not stop hooks/MCP startup.","sources":["config","config_paths","agent","plugin","plugin_loader"]}],"optional_shell_extension":{"text":"Proposed shell policy: replace bash:deny with {\"*\":\"deny\",\"${APPROVED_COMMAND_PATTERN}\":\"allow\"} after reviewing executable/pattern. Approved builds can execute repository code, read OS-visible inputs and mutate mounts. Retain outer isolation; test compounds/substitutions/redirections/external paths. ask+--auto is not a whitelist.","sources":["permissions_doc","permissions","run"],"status":"proposed policy extension"},"parallel_children_extension":{"text":"Tagged task supports foreground and asynchronous background children; experimentalBackgroundSubagents defaults true and exposes background input. Cost propagation anticipates parallel tasks. Proposed enablement: task:{\"*\":\"deny\",\"${APPROVED_SUBAGENT_NAME}\":\"allow\"}, reviewed child model/permissions, external concurrency bounds, inherited sandbox and outer isolation. Keep other orchestration denied; validate metering/cancellation/drain. Separate worker containers give stronger isolation for independent parallel jobs.","sources":["task","runtime_flags","cost_propagation","permissions_doc","sandbox_policy"],"status":"shipped mechanisms; proposed integration extension"}},"integration_gaps":[{"text":"Feasible unattended candidate, not ranked here. Adapter must add supervision, whole-process isolation, explicit inference route, scoped auth, usage reconciliation and artifact acceptance.","sources":["run","sandbox_policy","usage_schema"],"status":"assessment"},{"text":"Unverified: binary/backend enforcement, model entitlements/provider usage completeness, subscription-relay compatibility, all-child drain behavior and final billing reconciliation. Tagged source presence is not execution proof. cli.md autonomous-mode claims conflict with run.ts as detailed above. Upgrades require revalidation.","sources":["run","drain","task","chatgpt","session","cli_doc"],"status":"unresolved / contradictory evidence"}],"verification_plan":{"status":"Proposed small acceptance checklist only; no runtime outcomes claimed.","checks":[{"test":"Pin and provenance","accept":"Verify platform artifacts/image digest/version and effective config/build-agent permissions. Confirm no daemon, inherited/project overrides, external plugins or MCP.","sources":["npm","run","daemon","config","plugin"]},{"test":"Headless lifecycle","accept":"Tiny argv and closed-EOF stdin file jobs in a path with spaces: fresh session, file, drain, exit. Inject missing file/model/auth/stream failure and supervisor timeout; no prompt/hang.","sources":["run","run_input","drain"]},{"test":"Permission regression with and without --auto","accept":"With/without --auto deny bash/network/external/delegation/out-of-scope edits. Ordinary ask rejects, auto ask approves; escalation rejects. Tool denial need not force nonzero. Effective policy cannot gain repository overrides.","sources":["run","permissions","agent","config"]},{"test":"OS boundary and online route","accept":"Verify output write, outer read/write/socket/metadata restrictions, and model inference only via relay. Unsupported inner backend fails closed. Check nested bwrap without broad privilege.","sources":["sandbox_policy","bwrap","sandbox_network","sandbox_doc"]},{"test":"Metering reconciliation","accept":"Compare tiny multistep/cache/reasoning usage with export and relay. Replay duplicates and resume: no extra count. Kill/omit usage: incomplete, not zero. Explicit title and compaction-off suppress auxiliary calls.","sources":["usage_schema","session","processor","prompt","export"]},{"test":"Optional children gate","accept":"Before enabling children, reconcile two tiny foreground/background children and propagated costs without double-counting; verify drain, failure, cancellation, concurrency and whole-worker deadline.","sources":["task","run_auto","cost_propagation","drain","sandbox_policy"]}]},"sources":{"release":"https://github.com/Kilo-Org/kilocode/releases/tag/v7.8.18","latest":"https://api.github.com/repos/Kilo-Org/kilocode/releases/latest","npm":"https://registry.npmjs.org/@kilocode%2fcli","license":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/LICENSE","cli_doc":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-docs/pages/code-with-ai/platforms/cli.md","cli_ref":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-docs/pages/code-with-ai/platforms/cli-reference.md","run":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/cli/cmd/run.ts","run_input":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/cli/cmd/run-stdin.ts","drain":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/cli/run-drain.ts","daemon":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/daemon/client.ts","permissions_doc":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-docs/pages/customize/agent-permissions.md","permissions":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/permission/index.ts","permission_schema":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/core/src/v1/config/permission.ts","agent":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/agent/agent.ts","agent_schema":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/core/src/v1/config/agent.ts","config":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/config/config.ts","config_paths":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/config/paths.ts","config_schema":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/core/src/v1/config/config.ts","flags":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/core/src/flag/flag.ts","runtime_flags":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/effect/runtime-flags.ts","global":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/core/src/global.ts","auth":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/auth/index.ts","providers":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/provider/provider.ts","provider_schema":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/core/src/v1/config/provider.ts","chatgpt":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-docs/pages/ai-providers/openai-chatgpt-plus-pro.md","copilot":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/plugin/github-copilot/copilot.ts","sandbox_doc":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-docs/pages/getting-started/settings/sandboxing.md","sandbox_config":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/sandbox/config.ts","sandbox_policy":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/sandbox/policy.ts","sandbox_network":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/sandbox/network.ts","sandbox_network_tools":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/sandbox/network-tools.ts","bwrap":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-sandbox/src/bubblewrap.ts","seatbelt":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/kilo-sandbox/src/seatbelt.ts","package":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/package.json","plugin":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/plugin/index.ts","plugin_loader":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/plugin/loader.ts","usage_schema":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/schema/src/v1/session.ts","session":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/session/session.ts","processor":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/session/processor.ts","prompt":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/session/prompt.ts","provider_cost":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/session/index.ts","cost_propagation":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/session/cost-propagation.ts","export":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/cli/cmd/export.ts","run_auto":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/kilocode/cli/run-auto.ts","task":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/tool/task.ts","write":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/tool/write.ts","patch":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/tool/apply_patch.ts","grep":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/tool/grep.ts","glob":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/tool/glob.ts","instruction":"https://github.com/Kilo-Org/kilocode/blob/v7.8.18/packages/opencode/src/session/instruction.ts"}}