v0.6.1: sandbox persistence on session resume

Add Sandbox bool to Session struct. When a session is created with
--sandbox, the flag is saved. On resume (kode continue, kode repl --id),
the sandbox is auto-re-enabled if the current config has it disabled,
preventing accidental escape from the sandboxed environment.

Changes:
- internal/session/session.go: add Sandbox field to Session
- cmd/kode/main.go: set Sandbox on session create in run(), check
  on resume in continueCmd()
- cmd/kode/repl.go: restructure to load session before agent creation,
  check Sandbox flag, set on new sessions
- docs/SESSIONS.md: document sandbox persistence behavior

Author: jkyberneees

cmd/kode/main.go

@@ -587,6 +587,8 @@ func run(args []string) error {
 		if err != nil {
 			return fmt.Errorf("save session: %w", err)
 		}
+		sess.Sandbox = resolved.Sandbox
+		store.Save(sess)
 		fmt.Fprintf(os.Stderr, "kode: session %s saved — continue with: kode continue \"...\"\n", sess.ID)
 	} else {
 		// Single-shot mode (default)
@@ -785,6 +787,12 @@ func continueCmd(args []string) error {
 	// Resolve config (no CLI flags for continue — uses session's model)
 	resolved := config.LoadConfig(config.CLIFlags{Model: sess.Model})
 
+	// Auto-apply sandbox if session was sandboxed (even if config changed)
+	if sess.Sandbox && !resolved.Sandbox {
+		resolved.Sandbox = true
+		fmt.Fprintf(os.Stderr, "kode: session was sandboxed — enabling sandbox for this continuation\n")
+	}
+
 	systemMessage := resolved.System
 	if systemMessage == "" {
 		systemMessage = defaultSystem

cmd/kode/repl.go

@@ -31,13 +31,28 @@ func replCmd(args []string) error {
 		return fmt.Errorf("session store: %w", err)
 	}
 
-	// Resolve config
+	// Load or create session first — needed to know sandbox state
+	var sess *session.Session
+	if sessionID != "" {
+		sess, err = store.Load(sessionID)
+		if err != nil {
+			return fmt.Errorf("load session %q: %w", sessionID, err)
+		}
+	}
+
+	// Resolve config (before session creation so Session.Sandbox is set)
 	resolved := config.LoadConfig(config.CLIFlags{})
 	systemMessage := resolved.System
 	if systemMessage == "" {
 		systemMessage = defaultSystem
 	}
 
+	// Auto-apply sandbox if resuming a sandboxed session
+	if sess != nil && sess.Sandbox && !resolved.Sandbox {
+		resolved.Sandbox = true
+		fmt.Fprintf(os.Stderr, "kode: session was sandboxed — enabling sandbox\n")
+	}
+
 	// Build tools
 	tools := builtinTools()
 	var sandboxCleanup func() error
@@ -85,15 +100,8 @@ func replCmd(args []string) error {
 	}
 	defer agent.Close()
 
-	// Load or create session
-	var sess *session.Session
-	if sessionID != "" {
-		sess, err = store.Load(sessionID)
-		if err != nil {
-			return fmt.Errorf("load session %q: %w", sessionID, err)
-		}
-	} else {
-		// Start fresh session with just the system message
+	// Create session if not resuming one
+	if sess == nil {
 		sess, err = store.Create(
 			[]llm.Message{{Role: "system", Content: systemMessage}},
 			resolved.Model,
@@ -102,6 +110,8 @@ func replCmd(args []string) error {
 		if err != nil {
 			return fmt.Errorf("create session: %w", err)
 		}
+		sess.Sandbox = resolved.Sandbox
+		store.Save(sess)
 	}
 
 	fmt.Fprintf(os.Stderr, "\nkode ⚡ %s · session %s\n\n", modelLabel, sess.ID)
@@ -178,6 +188,9 @@ func handleREPLCommand(input string, sess *session.Session) bool {
 		fmt.Fprintf(os.Stderr, "Session: %s\n", sess.ID)
 		fmt.Fprintf(os.Stderr, "Model:   %s\n", sess.Model)
 		fmt.Fprintf(os.Stderr, "Turns:   %d\n", sess.Turns)
+		if sess.Sandbox {
+			fmt.Fprintf(os.Stderr, "Sandbox: yes\n")
+		}
 	default:
 		fmt.Fprintf(os.Stderr, "Unknown command: %s  (/help for commands)\n", input)
 	}

docs/SESSIONS.md

@@ -115,3 +115,19 @@ Sessions are stored as JSON at `~/.kode/sessions/<id>.json`:
 ```
 
 The `Session` struct has all public fields, enabling direct manipulation. This makes advanced operations (editing, truncating, merging) trivial — load, mutate, save.
+
+## Sandbox persistence
+
+When a session is created with `--sandbox`, the `sandbox` flag is stored in the session file. On resume (`kode continue` or `kode repl --id <id>`), the sandbox is automatically re-enabled even if the current config has it disabled:
+
+```bash
+kode run --session --sandbox "Install deps and build"
+# → session saved with sandbox=true
+
+# Later, in a different terminal without sandbox config:
+kode continue "Run the test suite"
+# → kode: session was sandboxed — enabling sandbox for this continuation
+```
+
+This prevents accidentally escaping the sandbox on resume. The sandbox image/network/memory still come from the **current** config — only the toggle bit is persisted. To force-disable sandbox on resume, pass `kode continue` in a project with `"sandbox": false` in `./kode.json` and the session flag will be overridden by the explicit config.
+

internal/session/session.go

@@ -39,6 +39,7 @@ type Session struct {
 	Model     string         `json:"model"`      // model name used
 	Turns     int            `json:"turns"`       // number of user turns
 	Task      string         `json:"task"`        // first user message (label)
+	Sandbox   bool           `json:"sandbox"`     // was sandboxed — auto-apply on resume
 	Messages  []llm.Message  `json:"messages"`    // full conversation history
 }