[kilo-code-bot]

Summary

MVP-2 of the "commit as user via GitHub App user tokens" convoy. Implements the full OAuth connect flow end-to-end:

• connectUserIdentity tRPC mutation (github-apps-router.ts): generates a signed JWT OAuth state and returns a GitHub authorize URL
• OAuth callback route (/api/integrations/github/user-connect/callback/route.ts): exchanges the code for a user token via @octokit/oauth-methods, resolves GitHub identity, encrypts and upserts the token into user_github_app_tokens
• getUserConnectionStatus query: returns connected/expired/disconnected status + login without exposing the token
• disconnectUserIdentity mutation: revokes the GitHub authorization and deletes the local row
• Settings UI card (GitHubIntegrationDetails.tsx): "Commit as You" card gated by enableUserTokens flag showing connect/reconnect/disconnect states
• getUserTokenForRepo RPC in git-token-service (user-github-token-service.ts): decrypts and returns a valid token for a given repo if available; used by cloud-agent-next in MVP-3
• OAuth state helper (oauth-state.ts): sign/verify HMAC-SHA256 JWT state with TTL
• GDPR soft-delete (user.ts): deletes user_github_app_tokens rows in softDeleteUser
• Typecheck fixes: expiresAt union narrowing, toISOString() for timestamp string columns, missing eq import

Verification

• tsgo --noEmit -p apps/web/tsconfig.json — passes (EXIT 0)
• pnpm --filter cloudflare-git-token-service run typecheck — passes (EXIT 0)
• pnpm --filter @kilocode/db run typecheck — passes (EXIT 0)
• Unit tests (github-apps-router.test.ts, callback/route.test.ts, oauth-state.test.ts) require Postgres — skipped in this environment (no DB available); tests are written and structurally correct

Visual Changes

N/A (settings UI card is feature-flagged behind enableUserTokens)

Reviewer Notes

• This branch cherry-picks the two MVP-2 implementation commits from gt/toast/4b8b7e18 onto the convoy feature branch head, plus a fix commit for typecheck errors
• The getUserTokenForRepo RPC is used by MVP-3 (cloud-agent-next) which is in a parallel branch
• Token expiry defaults to 8h when GitHub App has expiration disabled (per MVP spec)

[kilo-code-bot]

Three groups of unused imports need to be cleaned up — per coding standards the linter will flag these and the correct fix is removal, not _-prefixing.

1. getUserFromAuth imported in route.ts but never called.
2. isNull, gt, safeReturnTo, encryptWithSymmetricKey imported in github-apps-router.ts but never referenced.
3. isNull, lte imported in user-github-token-service.ts but never referenced.

Otherwise the implementation looks correct — HMAC-signed state, timing-safe comparison, encryption-at-rest, GDPR delete in softDeleteUser, repo-access cache, proper fallback in errorRedirect. No secrets are logged.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Previously Flagged — All Resolved ✓

The 7 unused import warnings from the first review have all been cleaned up in the follow-up commit (71d1834c6):

File	Fix
callback/route.ts	Removed getUserFromAuth, eq, and captureMessage imports
github-apps-router.ts	Removed isNull, gt, safeReturnTo, and encryptWithSymmetricKey imports
user-github-token-service.ts	Removed isNull and lte imports

Files Reviewed (9 files)

• apps/web/src/app/(app)/integrations/github/page.tsx
• apps/web/src/app/api/integrations/github/user-connect/callback/route.ts
• apps/web/src/app/api/integrations/github/user-connect/callback/route.test.ts
• apps/web/src/components/integrations/GitHubIntegrationDetails.tsx
• apps/web/src/lib/config.server.ts
• apps/web/src/lib/integrations/platforms/github/oauth-state.ts
• apps/web/src/lib/user.ts
• apps/web/src/routers/github-apps-router.ts
• services/git-token-service/src/user-github-token-service.ts

---

_{Reviewed by claude-4.6-sonnet-20260217 · 239,066 tokens}