[marius-kilocode]

What Problem This Solves

On Linux, with the sandbox enabled and allowed_hosts set, the write and edit tools fail with:

Unknown: Sandbox.mutate (~workspace~): Filesystem worker returned an invalid response

File changes through bash still work.

Why This Change Was Made

write and edit write files through a separate filesystem worker. Kilo starts that worker by running its own binary with BUN_BE_BUN=1, which makes the binary run the worker script instead of the CLI.

When allowed_hosts is set, the sandbox network mode is proxy. On Linux, proxy mode sends every sandboxed process through a network relay. The relay removes BUN_BE_BUN before it starts the command. That is correct for user shell commands, but it breaks the worker: the binary starts the CLI instead. The CLI writes nothing to stdout, so Kilo reports an invalid response. The CLI also tries to write to its own data folder, which the sandbox denies. That matches the report of a write under .local/share/kilo/tool-output.

The regression came from #12075, which added the relay and its delete environment.BUN_BE_BUN line. Before that PR there was no relay.

User Impact

write and edit work on Linux again when the sandbox allows specific hosts. The worker now always runs with network access off, which it does not need. Filesystem write rules and all other commands are unchanged.

Evidence

Reproduced and verified in an Ubuntu 24.04 arm64 container with bubblewrap, using the official @kilocode/cli-linux-arm64@7.8.1 package and a local OpenAI-compatible server that answers with a write tool call.

Binary	allowed_hosts	Result
7.8.1	[] (deny mode)	Write works
7.8.1	["api.github.com"]	Unknown: Sandbox.mutate (/work): Filesystem worker returned an invalid response
This branch	["api.github.com"]	Write works
This branch	[]	Write works

Direct worker check on 7.8.1: with BUN_BE_BUN=1 it returns {"ok":true}. Without it, the binary starts the CLI, prints Failed to change directory to .../kilo-sandbox-mutation-worker.js, writes nothing to stdout, and exits with code 0.

Checks: packages/kilo-sandbox tests (61 pass), packages/kilo-sandbox typecheck, and packages/opencode sandbox tests (103 pass).

Fixes #14719.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• packages/kilo-sandbox/src/mutation.ts
• .changeset/sandbox-linux-allowed-hosts-writes.md

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}