fix: allow Kilo Code shell commands when tools are omitted

adapters/typescript/kilo/README.md

@@ -84,10 +84,11 @@ variables, explicit NeMo Fabric `environment.env` values, variables named by
 `environment.env_names`, and the selected model credential. Other parent
 variables are not forwarded.
 
-The adapter is non-interactive. It denies follow-up questions, access outside
-the workspace, doom-loop continuation, and direct reads of `.env` files. These
-permission rules are not a filesystem sandbox and cannot prevent an enabled
-shell tool from reading workspace files.
+The adapter is non-interactive. When `tools.enabled` is omitted, it allows shell
+commands unless `tools.blocked` lists `bash`. It denies follow-up questions,
+access outside the workspace, doom-loop continuation, and direct reads of `.env`
+files. These permission rules are not a filesystem sandbox and cannot prevent an
+enabled shell tool from reading workspace files.
 
 `models.max_tokens`, provider-specific model settings, append-mode system
 instructions, streaming, cancellation, service mode, and Relay telemetry are

adapters/typescript/kilo/src/kilo-sdk.ts

@@ -78,6 +78,7 @@ async function skillPaths(input: AdapterStartInput): Promise<string[]> {
   return paths;
 }
 
+/** Map normalized tool policy to non-interactive Kilo permissions, with blocked tools taking precedence. */
 function toolPermission(input: AdapterStartInput): Record<string, unknown> {
   if (input.config.tools?.definitions !== undefined) {
     throw new LifecycleError("kilo_tool_definitions_unsupported", "Kilo Code does not support normalized tool definitions through this adapter");
@@ -107,6 +108,8 @@ function toolPermission(input: AdapterStartInput): Record<string, unknown> {
     }
   } else {
     permission.read = protectedRead;
+    // Kilo Code asks before shell commands outside its read-only allowlist, and nothing answers in a headless run.
+    permission.bash = "allow";
   }
   for (const name of blocked) permission[name] = "deny";
   return permission;

adapters/typescript/kilo/test/kilo-sdk.test.mjs

@@ -187,6 +187,7 @@ test("denies interactive permissions when normalized tools are omitted", async (
       external_directory: "deny",
       doom_loop: "deny",
       read: {"*": "allow", "*.env": "deny", "*.env.*": "deny", "*.env.example": "allow"},
+      bash: "allow",
     });
     assert.deepEqual(projected.agent, {build: {model: "nvidia/nemotron"}});
     await handle.stop();

docs/integrations/harness/kilo.mdx

@@ -129,11 +129,12 @@ variables, explicit NeMo Fabric `environment.env` values, variables named by
 `environment.env_names`, and the selected model credential. Other parent
 variables are not forwarded.
 
-The adapter is non-interactive. It denies follow-up questions, access outside
-the workspace, doom-loop continuation, and direct reads of `.env` files. These
-permission rules are not a filesystem sandbox and cannot prevent an enabled
-shell tool from reading workspace files. Use an environment provider when the
-task needs stronger isolation.
+The adapter is non-interactive. When `tools.enabled` is omitted, it allows shell
+commands unless `tools.blocked` lists `bash`. It denies follow-up questions,
+access outside the workspace, doom-loop continuation, and direct reads of `.env`
+files. These permission rules are not a filesystem sandbox and cannot prevent an
+enabled shell tool from reading workspace files. Use an environment provider
+when the task needs stronger isolation.
 
 `models.max_tokens`, provider-specific model settings, append-mode system
 instructions, streaming, cancellation, service mode, and Relay telemetry are