Description
When Kilo Code generates a test file using a shell heredoc, its approval prompt appears to present or request approval for every token in the heredoc body as though it were part of a Unix command. This is misleading and makes it difficult to determine what will actually execute.
In the example below, only cat is executed by the shell. The JavaScript between << 'EOF' and the terminating EOF is literal file content written to /tmp/jsdom_test.mjs; it is not executed at this stage.
import { JSDOM } from 'jsdom';
const dom = new JSDOM('<body></body>');
const body = dom.window.document.body;
body.style.setProperty('--accent-h', '220');
body.style.setProperty('--accent-s', '60%');
const temp =
body.ownerDocument.createElement('div');
EOF```
Because the delimiter is quoted (<< 'EOF'), the shell should copy the contents literally without variable expansion or command substitution. A separate subsequent command, such as node /tmp/jsdom_test.mjs, would be required to execute the generated JavaScript.
### Plugins
kilo code in vscode
### Kilo version
7.4.9
### Steps to reproduce
1. Configure terminal-command permissions to **Ask**.
2. Ask Kilo Code to generate a JavaScript test using a heredoc, such as:
```sh
cat > /tmp/jsdom_test.mjs << 'EOF'
import { JSDOM } from 'jsdom';
const dom = new JSDOM('<body></body>');
console.log(dom.window.document.body);
EOF
```
3. Observe the terminal approval request.
4. Note that the JavaScript payload is not clearly labeled as literal file content rather than shell code.
### Screenshot and/or share link
_No response_
### Operating System
Windows 11
### Terminal
_No response_
Description
When Kilo Code generates a test file using a shell heredoc, its approval prompt appears to present or request approval for every token in the heredoc body as though it were part of a Unix command. This is misleading and makes it difficult to determine what will actually execute.
In the example below, only cat is executed by the shell. The JavaScript between << 'EOF' and the terminating EOF is literal file content written to /tmp/jsdom_test.mjs; it is not executed at this stage.