[FEATURE]: Configurable CLI Binary Path for Enterprise / Restricted Environments

[castafe]

[FEATURE]: Configurable CLI Binary Path for Enterprise / Restricted Environments

Summary

Add a mechanism — via VS Code setting, environment variable, or configuration file — to override the hardcoded path used by the VS Code extension to locate the kilo CLI binary. This is essential for users operating in corporate environments where application execution is restricted by security policies such as AppLocker or Windows Defender Application Control (WDAC).

---

Problem Statement

In enterprise environments, security teams commonly enforce application whitelisting policies (AppLocker, WDAC, Group Policy) that block execution of binaries outside approved directories. The VS Code extension currently resolves the CLI binary path with a hardcoded function:

getCliPath() {
    let binary = process.platform === 'win32' ? 'kilo.exe' : 'kilo';
    let fullPath = path.join(this.context.extensionPath, 'bin', binary);
    return fullPath;
}

The resulting path — %USERPROFILE%\.vscode\extensions\kilocode.kilo-code-X.X.X\bin\kilo.exe — is a user-writable directory, which corporate policies typically block by design to prevent execution of unvetted software. There is no way to override this path without patching extension.js directly.

Observed Failure

When the binary is blocked, the extension fails silently from the user's perspective: the Sign In button does nothing, settings cannot be saved, and the "Not connected to CLI backend" error appears. The actual root cause is only visible in the VS Code Developer Tools console:

ServerManager: Spawning CLI process: ...\bin\kilo.exe ▶ ['serve', '--port', '0']
ERR KiloProvider: ✖ Failed to initialize connection: Error: spawn UNKNOWN

Running the binary manually confirms the root cause:

Program 'kilo.exe' failed to run: This program is blocked by group policy.
For more information, contact your system administrator.

---

Proposed Solution

Introduce an override mechanism — in order of implementation preference:

Option A: VS Code Setting (Recommended)

Expose a new contributes.configuration property in package.json:

"kilo-code.new.cliPath": {
    "type": "string",
    "default": "",
    "description": "Override the path to the Kilo CLI binary. When empty, the bundled binary is used. Useful in environments where the default path is blocked by security policy."
}

Then in getCliPath():

getCliPath(): string {
    const override = vscode.workspace.getConfiguration('kilo-code.new').get<string>('cliPath');
    if (override && override.trim().length > 0) {
        return override.trim();
    }
    const binary = process.platform === 'win32' ? 'kilo.exe' : 'kilo';
    return path.join(this.context.extensionPath, 'bin', binary);
}

Option B: Environment Variable

Check for KILO_CLI_PATH (or KILOCODE_CLI_PATH) before falling back to the bundled binary:

getCliPath(): string {
    const envOverride = process.env.KILO_CLI_PATH;
    if (envOverride) return envOverride;
    const binary = process.platform === 'win32' ? 'kilo.exe' : 'kilo';
    return path.join(this.context.extensionPath, 'bin', binary);
}

Option C: kilo.jsonc Config Field

Add a top-level cliBinaryPath field to the kilo.jsonc configuration file that the extension reads at startup.

---

Use Cases

Scenario	Impact without fix	Impact with fix
Corporate AppLocker / WDAC policy	Extension completely non-functional	User copies binary to approved path, sets override
Air-gapped / offline environments	Bundled binary may not be trusted	Admin-provided binary in approved location
Managed devices (JRC, enterprise IT)	Requires IT intervention for extension binary	IT approves one directory; user self-serves
CI/CD pipelines with locked-down agents	Cannot use Kilo VS Code extension	Path set via environment variable

---

Why This Is Low Risk

• The override is opt-in: default behavior is identical to today
• No security regression: users choosing an override path are responsible for the binary they point to — no different from any other CLI tool
• The VS Code setting is user-scoped, consistent with how other extensions (e.g., Python interpreter path, ESLint binary path) handle this pattern

---

Environment Where Issue Was Confirmed

• OS: Windows 11, corporate-managed device
• VS Code: latest stable
• Kilo Code extension: v7.2.25 (win32-x64)
• Restriction mechanism: Group Policy / AppLocker (confirmed via This program is blocked by group policy error)
• Affected path: C:\Users\<user>\.vscode\extensions\kilocode.kilo-code-7.2.25-win32-x64\bin\kilo.exe

---

Workarounds (Inadequate)

The following workarounds were investigated and found insufficient:

• KILOCODE_DEV_CLI_PATH env var: Does not override the extension's CLI path. It is an internal development variable used by the CLI to locate the extension source, not the reverse.
• kilo-code.new.* settings: No CLI path override exists in contributes.configuration (verified in package.json v7.2.25).
• Hardlink: Requires write access to the extension directory, which may also be restricted.
• Patching extension.js: Fragile, reverts on every extension update.

---

References

• Kilo Code VS Code extension architecture: ServerManager.getCliPath() in dist/extension.js
• AppLocker documentation: Microsoft Learn — Executable rules in AppLocker
• Similar pattern implemented by other VS Code extensions: Python (python.pythonPath), ESLint (eslint.nodePath), Prettier (prettier.prettierPath)