feat(cloud-agent-next): contain managed sandbox credentials by eshurakov · Pull Request #5552 · Kilo-Org/cloud

eshurakov · 2026-08-27T08:38:17Z

Summary

Make managed credential containment mandatory for control-plane workspace sessions on Cloudflare and Vercel; guests receive opaque aliases, not managed upstream credentials.
Reuse the existing broker and native outbound/network-policy enforcement, bound to the exact physical allocation and authorized worktree/root membership.
Use one isolated Kilo process/auth environment per worktree, shared by its registered roots; preserve custom profile GitHub token overrides.
Integrate hidden-summit lifecycle/acquisition/outcome fencing with glossy-gull legacy-only containment controls.
Fix reproduced integration races in credential-expiry recovery, cancellation of queued worktree preparation, and complete per-worktree auto-commit serialization.
Pin only the Cloud Agent CI job to Bun 1.3.14: floating latest selected Bun 1.4.0, which exposes an unhandled cancellation promise in the pinned SDK. No SDK, production Docker, or dependency changes.

Native PR stack

Stack #5752: main -> #5670 hidden-summit -> #5623 glossy-gull -> #5552 eager-hollow -> #5751 dreamy-marsh.

The older Vercel-only remote lineage is replaced by the reviewed local implementation; its profile-token override fix is preserved.

Verification

Final-HEAD CI passed: 4,084 Node tests (3 existing skips), 453 Workers tests, 635 wrapper tests, running Bun 1.3.14.
Final-HEAD TruffleHog passed with zero findings over the full commit range. Synthetic URI fixtures use explicit URL construction, folded into their introducing commit; assertions remain and no scanner rule was disabled.
Broker full suite: 553 passed. Service/wrapper/broker lint and typechecks, explicit integration-file lint, formatting and whitespace checks passed.
Reproduced the three integration regressions before fixing them, including actual temporary Git/local-remote auto-commit concurrency.
Local mandatory Cloudflare containment passed private/public repository cloning, cold/warm turns, canonical interruption/follow-up, stable opaque aliases, native credential redemption, and nonempty persisted ingest. The top stack also verified same-worktree process/alias sharing, different-worktree isolation, terminals and scoped deletion.
Final CI-only rewrite changes no production-code blobs, paths or modes; full local wrapper rerun passed 635/635.

Rollout and limits

A matching fresh wrapper image/snapshot is required. No production deployment or new live Vercel acceptance.
Compatible Bitbucket broker readers must precede new OAuth credential-ID claims; rollback to old strict readers can reject outstanding capabilities.
Native local workerd/egress can delay upstream cancellation after the client aborts. Independently reproduced below Kilo; the unchanged repository forwarder preserves signals. Canonical interruption and persisted MessageAbortedError pass; production transport behavior is not established.
Existing lifecycle rollout limitations, including delayed destination-side launch fencing, remain explicit. Merging is not approval to enable the control-plane rollout.
Plans and unrelated worktree changes are excluded.

kilo-code-bot · 2026-08-27T10:55:34Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Full review of managed credential containment after history rewrite found no high-confidence issues.

Files Reviewed (83 files)

.github/workflows/ci.yml
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.test.ts
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts
services/cloud-agent-next/src/kilo/kilo-targets.test.ts
services/cloud-agent-next/src/kilo/kilo-targets.ts
services/cloud-agent-next/src/persistence/SandboxControl.ts
services/cloud-agent-next/src/persistence/session-metadata.test.ts
services/cloud-agent-next/src/persistence/session-metadata.ts
services/cloud-agent-next/src/sandbox-control/cloudflare-provider.test.ts
services/cloud-agent-next/src/sandbox-control/cloudflare-provider.ts
services/cloud-agent-next/src/sandbox-control/deadlines.ts
services/cloud-agent-next/src/sandbox-control/durable-state.test.ts
services/cloud-agent-next/src/sandbox-control/durable-state.ts
services/cloud-agent-next/src/sandbox-control/lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/managed-credential.test.ts
services/cloud-agent-next/src/sandbox-control/managed-credential.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.ts
services/cloud-agent-next/src/sandbox-control/provider.ts
services/cloud-agent-next/src/sandbox-control/session-credentials.test.ts
services/cloud-agent-next/src/sandbox-control/session-credentials.ts
services/cloud-agent-next/src/sandbox-control/session-routes.test.ts
services/cloud-agent-next/src/sandbox-control/session-routes.ts
services/cloud-agent-next/src/sandbox-control/socket.test.ts
services/cloud-agent-next/src/sandbox-control/socket.ts
services/cloud-agent-next/src/sandbox-control/terminal-billing.test.ts
services/cloud-agent-next/src/sandbox-control/terminal-billing.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.test.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.ts
services/cloud-agent-next/src/sandbox-outbound.test.ts
services/cloud-agent-next/src/sandbox-outbound.ts
services/cloud-agent-next/src/sandbox-session/SandboxSession.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.test.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.ts
services/cloud-agent-next/src/sandbox-session/control-rpc.ts
services/cloud-agent-next/src/sandbox-session/session-message-queue.test.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.test.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.ts
services/cloud-agent-next/src/services/git-token-service-client.test.ts
services/cloud-agent-next/src/services/git-token-service-client.ts
services/cloud-agent-next/src/session/session-prepare.test.ts
services/cloud-agent-next/src/session/session-registration.ts
services/cloud-agent-next/src/shared/sandbox-control-protocol.ts
services/cloud-agent-next/test/e2e/README.md
services/cloud-agent-next/test/integration/sandbox-control.test.ts
services/cloud-agent-next/test/integration/sandbox-terminal.test.ts
services/cloud-agent-next/test/unit/wrapper/auto-commit.test.ts
services/cloud-agent-next/wrapper/src/auto-commit.ts
services/cloud-agent-next/wrapper/src/bitbucket-review-cli.test.ts
services/cloud-agent-next/wrapper/src/control/apply-attach.test.ts
services/cloud-agent-next/wrapper/src/control/apply-attach.ts
services/cloud-agent-next/wrapper/src/control/feed.test.ts
services/cloud-agent-next/wrapper/src/control/feed.ts
services/cloud-agent-next/wrapper/src/control/main.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-handlers.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-handlers.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-runtime.ts
services/cloud-agent-next/wrapper/src/control/session-directories.test.ts
services/cloud-agent-next/wrapper/src/control/session-directories.ts
services/cloud-agent-next/wrapper/src/control/terminal-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/terminal-runtime.ts
services/cloud-agent-next/wrapper/src/control/worktree-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/worktree-runtime.ts
services/cloud-agent-next/wrapper/src/kilo-api.test.ts
services/cloud-agent-next/wrapper/src/kilo-api.ts
services/cloud-agent-next/wrapper/src/redact-output.test.ts
services/cloud-agent-next/wrapper/src/redact-output.ts
services/cloud-agent-next/wrapper/src/restore-session.test.ts
services/cloud-agent-next/wrapper/src/restore-session.ts
services/cloud-agent-next/wrapper/src/utils.ts
services/git-token-service/src/bitbucket-authorization-service.test.ts
services/git-token-service/src/bitbucket-authorization-service.ts
services/git-token-service/src/bitbucket-runtime-token-resolver.test.ts
services/git-token-service/src/bitbucket-runtime-token-resolver.ts
services/git-token-service/src/bitbucket-session-capability.test.ts
services/git-token-service/src/bitbucket-session-capability.ts
services/git-token-service/src/index.test.ts
services/git-token-service/src/index.ts

Previous Review Summaries (4 snapshots, latest commit 08e1bee)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `08e1bee`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of Vercel runtime fencing and idle-lease renewal found no high-confidence issues.

Files Reviewed (4 files)

services/cloud-agent-next/src/persistence/SandboxControl.ts
services/cloud-agent-next/src/sandbox-session/SandboxSession.ts
services/cloud-agent-next/src/sandbox-session/session-message-queue.test.ts
services/cloud-agent-next/test/integration/sandbox-control.test.ts

Previous review (commit `8ce1f09`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (83 files)

.github/workflows/ci.yml
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.test.ts
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts
services/cloud-agent-next/src/kilo/kilo-targets.test.ts
services/cloud-agent-next/src/kilo/kilo-targets.ts
services/cloud-agent-next/src/persistence/SandboxControl.ts
services/cloud-agent-next/src/persistence/session-metadata.test.ts
services/cloud-agent-next/src/persistence/session-metadata.ts
services/cloud-agent-next/src/sandbox-control/cloudflare-provider.test.ts
services/cloud-agent-next/src/sandbox-control/cloudflare-provider.ts
services/cloud-agent-next/src/sandbox-control/deadlines.ts
services/cloud-agent-next/src/sandbox-control/durable-state.test.ts
services/cloud-agent-next/src/sandbox-control/durable-state.ts
services/cloud-agent-next/src/sandbox-control/lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/managed-credential.test.ts
services/cloud-agent-next/src/sandbox-control/managed-credential.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.ts
services/cloud-agent-next/src/sandbox-control/provider.ts
services/cloud-agent-next/src/sandbox-control/session-credentials.test.ts
services/cloud-agent-next/src/sandbox-control/session-credentials.ts
services/cloud-agent-next/src/sandbox-control/session-routes.test.ts
services/cloud-agent-next/src/sandbox-control/session-routes.ts
services/cloud-agent-next/src/sandbox-control/socket.test.ts
services/cloud-agent-next/src/sandbox-control/socket.ts
services/cloud-agent-next/src/sandbox-control/terminal-billing.test.ts
services/cloud-agent-next/src/sandbox-control/terminal-billing.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.test.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.ts
services/cloud-agent-next/src/sandbox-outbound.test.ts
services/cloud-agent-next/src/sandbox-outbound.ts
services/cloud-agent-next/src/sandbox-session/SandboxSession.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.test.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.ts
services/cloud-agent-next/src/sandbox-session/control-rpc.ts
services/cloud-agent-next/src/sandbox-session/session-message-queue.test.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.test.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.ts
services/cloud-agent-next/src/services/git-token-service-client.test.ts
services/cloud-agent-next/src/services/git-token-service-client.ts
services/cloud-agent-next/src/session/session-prepare.test.ts
services/cloud-agent-next/src/session/session-registration.ts
services/cloud-agent-next/src/shared/sandbox-control-protocol.ts
services/cloud-agent-next/test/e2e/README.md
services/cloud-agent-next/test/integration/sandbox-control.test.ts
services/cloud-agent-next/test/integration/sandbox-terminal.test.ts
services/cloud-agent-next/test/unit/wrapper/auto-commit.test.ts
services/cloud-agent-next/wrapper/src/auto-commit.ts
services/cloud-agent-next/wrapper/src/bitbucket-review-cli.test.ts
services/cloud-agent-next/wrapper/src/control/apply-attach.test.ts
services/cloud-agent-next/wrapper/src/control/apply-attach.ts
services/cloud-agent-next/wrapper/src/control/feed.test.ts
services/cloud-agent-next/wrapper/src/control/feed.ts
services/cloud-agent-next/wrapper/src/control/main.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-handlers.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-handlers.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-runtime.ts
services/cloud-agent-next/wrapper/src/control/session-directories.test.ts
services/cloud-agent-next/wrapper/src/control/session-directories.ts
services/cloud-agent-next/wrapper/src/control/terminal-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/terminal-runtime.ts
services/cloud-agent-next/wrapper/src/control/worktree-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/worktree-runtime.ts
services/cloud-agent-next/wrapper/src/kilo-api.test.ts
services/cloud-agent-next/wrapper/src/kilo-api.ts
services/cloud-agent-next/wrapper/src/redact-output.test.ts
services/cloud-agent-next/wrapper/src/redact-output.ts
services/cloud-agent-next/wrapper/src/restore-session.test.ts
services/cloud-agent-next/wrapper/src/restore-session.ts
services/cloud-agent-next/wrapper/src/utils.ts
services/git-token-service/src/bitbucket-authorization-service.test.ts
services/git-token-service/src/bitbucket-authorization-service.ts
services/git-token-service/src/bitbucket-runtime-token-resolver.test.ts
services/git-token-service/src/bitbucket-runtime-token-resolver.ts
services/git-token-service/src/bitbucket-session-capability.test.ts
services/git-token-service/src/bitbucket-session-capability.ts
services/git-token-service/src/index.test.ts
services/git-token-service/src/index.ts

Previous review (commit `d4c4fe0`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (143 files)

ENVIRONMENT.md
services/cloud-agent-next/.dev.vars.example
services/cloud-agent-next/AGENTS.md
services/cloud-agent-next/src/agent-sandbox/cloudflare/cloudflare-agent-sandbox.ts
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts
services/cloud-agent-next/src/container-usage-context.ts
services/cloud-agent-next/src/container-usage.ts
services/cloud-agent-next/src/kilo/kilo-targets.ts
services/cloud-agent-next/src/kilo/wrapper-client.ts
services/cloud-agent-next/src/persistence/SandboxControl.ts
services/cloud-agent-next/src/persistence/session-metadata.ts
services/cloud-agent-next/src/persistence/types.ts
services/cloud-agent-next/src/sandbox-control/authoritative-release.ts
services/cloud-agent-next/src/sandbox-control/cloudflare-provider.ts
services/cloud-agent-next/src/sandbox-control/deadlines.ts
services/cloud-agent-next/src/sandbox-control/durable-state.ts
services/cloud-agent-next/src/sandbox-control/lost-connection.ts
services/cloud-agent-next/src/sandbox-control/managed-credential.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.ts
services/cloud-agent-next/src/sandbox-control/provider.ts
services/cloud-agent-next/src/sandbox-control/session-credentials.ts
services/cloud-agent-next/src/sandbox-control/session-routes.ts
services/cloud-agent-next/src/sandbox-control/socket.ts
services/cloud-agent-next/src/sandbox-control/status-projection.ts
services/cloud-agent-next/src/sandbox-control/terminal-billing.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.ts
services/cloud-agent-next/src/sandbox-id.ts
services/cloud-agent-next/src/sandbox-outbound.ts
services/cloud-agent-next/src/sandbox-session/SandboxSession.ts
services/cloud-agent-next/src/sandbox-session/accepted-overdue.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.ts
services/cloud-agent-next/src/sandbox-session/control-dispatch.ts
services/cloud-agent-next/src/sandbox-session/control-rpc.ts
services/cloud-agent-next/src/sandbox-session/sandbox-control-event.ts
services/cloud-agent-next/src/sandbox-session/session-message-queue.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.ts
services/cloud-agent-next/src/services/git-token-service-client.ts
services/cloud-agent-next/src/session/queries/events.ts
services/cloud-agent-next/src/session/queue-message.ts
services/cloud-agent-next/src/session/session-registration.ts
services/cloud-agent-next/src/shared/protocol.ts
services/cloud-agent-next/src/shared/sandbox-control-protocol.ts
services/cloud-agent-next/src/shared/tool-cgroup-env.ts
services/cloud-agent-next/src/types.ts
services/cloud-agent-next/src/websocket/stream.ts
services/cloud-agent-next/wrangler.jsonc
services/cloud-agent-next/wrapper/src/auto-commit.ts
services/cloud-agent-next/wrapper/src/connection.ts
services/cloud-agent-next/wrapper/src/control/apply-attach.ts
services/cloud-agent-next/wrapper/src/control/feed.ts
services/cloud-agent-next/wrapper/src/control/main.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-client.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-handlers.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-runtime.ts
services/cloud-agent-next/wrapper/src/control/session-directories.ts
services/cloud-agent-next/wrapper/src/control/terminal-runtime.ts
services/cloud-agent-next/wrapper/src/control/worktree-runtime.ts
services/cloud-agent-next/wrapper/src/kilo-api.ts
services/cloud-agent-next/wrapper/src/main.ts
services/cloud-agent-next/wrapper/src/redact-output.ts
services/cloud-agent-next/wrapper/src/restore-session.ts
services/cloud-agent-next/wrapper/src/session-bootstrap.ts
services/cloud-agent-next/wrapper/src/tool-cgroup.ts
services/cloud-agent-next/wrapper/src/utils.ts
services/git-token-service/src/bitbucket-authorization-service.ts
services/git-token-service/src/bitbucket-runtime-token-resolver.ts
services/git-token-service/src/bitbucket-session-capability.ts
services/git-token-service/src/index.ts
services/cloud-agent-next/src/agent-sandbox/cloudflare/cloudflare-agent-sandbox.test.ts
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.test.ts
services/cloud-agent-next/src/container-usage-context.test.ts
services/cloud-agent-next/src/container-usage.test.ts
services/cloud-agent-next/src/kilo/kilo-targets.test.ts
services/cloud-agent-next/src/kilo/wrapper-client.test.ts
services/cloud-agent-next/src/persistence/session-metadata.test.ts
services/cloud-agent-next/src/router.test.ts
services/cloud-agent-next/src/sandbox-control/cloudflare-provider.test.ts
services/cloud-agent-next/src/sandbox-control/durable-state.test.ts
services/cloud-agent-next/src/sandbox-control/lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/managed-credential.test.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/provider.test.ts
services/cloud-agent-next/src/sandbox-control/session-credentials.test.ts
services/cloud-agent-next/src/sandbox-control/session-routes.test.ts
services/cloud-agent-next/src/sandbox-control/socket.test.ts
services/cloud-agent-next/src/sandbox-control/status-projection.test.ts
services/cloud-agent-next/src/sandbox-control/terminal-billing.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.test.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.test.ts
services/cloud-agent-next/src/sandbox-id.test.ts
services/cloud-agent-next/src/sandbox-outbound.test.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.test.ts
services/cloud-agent-next/src/sandbox-session/control-dispatch.test.ts
services/cloud-agent-next/src/sandbox-session/session-message-queue.test.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.test.ts
services/cloud-agent-next/src/services/git-token-service-client.test.ts
services/cloud-agent-next/src/session-prepare.test.ts
services/cloud-agent-next/src/session/queue-message.test.ts
services/cloud-agent-next/src/session/session-prepare.test.ts
services/cloud-agent-next/src/websocket/stream.test.ts
services/cloud-agent-next/test/e2e/README.md
services/cloud-agent-next/test/e2e/client.ts
services/cloud-agent-next/test/e2e/lifecycle.ts
services/cloud-agent-next/test/e2e/run.ts
services/cloud-agent-next/test/integration/sandbox-control.test.ts
services/cloud-agent-next/test/integration/sandbox-terminal.test.ts
services/cloud-agent-next/test/integration/session/events.test.ts
services/cloud-agent-next/test/unit/wrapper/auto-commit.test.ts
services/cloud-agent-next/test/unit/wrapper/kilo-api.test.ts
services/cloud-agent-next/test/unit/wrapper/reconnection.test.ts
services/cloud-agent-next/worker-configuration.d.ts
services/cloud-agent-next/wrapper/src/bitbucket-review-cli.test.ts
services/cloud-agent-next/wrapper/src/control/apply-attach.test.ts
services/cloud-agent-next/wrapper/src/control/feed.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-client.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-handlers.test.ts
services/cloud-agent-next/wrapper/src/control/sandbox-control-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/session-directories.test.ts
services/cloud-agent-next/wrapper/src/control/terminal-runtime.test.ts
services/cloud-agent-next/wrapper/src/control/worktree-runtime.test.ts
services/cloud-agent-next/wrapper/src/kilo-api.test.ts
services/cloud-agent-next/wrapper/src/redact-output.test.ts
services/cloud-agent-next/wrapper/src/restore-session.test.ts
services/cloud-agent-next/wrapper/src/tool-cgroup.test.ts
services/git-token-service/src/bitbucket-authorization-service.test.ts
services/git-token-service/src/bitbucket-runtime-token-resolver.test.ts
services/git-token-service/src/bitbucket-session-capability.test.ts
services/git-token-service/src/index.test.ts
services/cloud-agent-next/src/sandbox-control/recovery/reconcile-observe-active-arms-grace.test.ts
services/cloud-agent-next/src/sandbox-control/recovery/reconcile-observe-terminal.test.ts
services/cloud-agent-next/src/sandbox-control/recovery/reconcile-observe-unknown-keeps-ref.test.ts
services/cloud-agent-next/src/sandbox-control/recovery/retryable-stop-keeps-provider-ref.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/accepted-overdue-rearms-then-fails-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/attach-exhausted-fails-waiting-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/create-throws-fails-waiting-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/prompt-exhausted-fails-waiting-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/provider-unknown-fails-waiting-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/startup-timeout-fails-waiting-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/warm-death-fails-waiting-queue.test.ts
services/cloud-agent-next/src/sandbox-session/recovery/wrapper-never-ready-fails-waiting-queue.test.ts

Previous review (commit `282cec2`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (22 files)

services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.test.ts
services/cloud-agent-next/src/kilo/kilo-targets.ts
services/cloud-agent-next/src/kilo/kilo-targets.test.ts
services/cloud-agent-next/src/persistence/SandboxControl.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.ts
services/cloud-agent-next/src/sandbox-control/physical-lifecycle.test.ts
services/cloud-agent-next/src/sandbox-control/provider.ts
services/cloud-agent-next/src/sandbox-control/socket.ts
services/cloud-agent-next/src/sandbox-control/socket.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.ts
services/cloud-agent-next/src/sandbox-control/vercel-network-policy.test.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.ts
services/cloud-agent-next/src/sandbox-control/vercel-provider.test.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.ts
services/cloud-agent-next/src/sandbox-control/wrapper-launch-env.test.ts
services/cloud-agent-next/src/sandbox-session/SandboxSession.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.ts
services/cloud-agent-next/src/sandbox-session/attach-payload.test.ts
services/cloud-agent-next/src/sandbox-session/control-rpc.ts
services/cloud-agent-next/src/sandbox-session/terminal-lifecycle.test.ts
services/cloud-agent-next/test/integration/sandbox-control.test.ts

_{Reviewed by grok-4.6 · Input: 238.4K · Output: 24.6K · Cached: 1.3M}

_{Review guidance: REVIEW.md from base branch eshurakov/glossy-gull}

eshurakov force-pushed the eshurakov/eager-hollow branch from 282cec2 to d4c4fe0 Compare August 30, 2026 07:14

eshurakov changed the title ~~feat(cloud-agent-next): contain Vercel sandbox credentials~~ feat(cloud-agent-next): contain managed sandbox credentials Aug 30, 2026

eshurakov changed the base branch from main to eshurakov/glossy-gull August 30, 2026 09:12

eshurakov force-pushed the eshurakov/eager-hollow branch from d4c4fe0 to 8ce1f09 Compare August 30, 2026 12:46

eshurakov force-pushed the eshurakov/eager-hollow branch from 8ce1f09 to 08e1bee Compare August 31, 2026 12:45

eshurakov requested a review from pandemicsyn August 31, 2026 17:37

iscekic approved these changes Sep 1, 2026

View reviewed changes

stacked auto-merge was automatically disabled September 1, 2026 10:56
Pull Request is not mergeable

eshurakov added 3 commits September 1, 2026 13:07

feat(cloud-agent-next): contain managed sandbox credentials

6245488

fix(cloud-agent-next): preserve worktree ordering and expiry cleanup

16c9bd5

ci(cloud-agent-next): pin Bun to 1.3.14

4d79d68

eshurakov force-pushed the eshurakov/eager-hollow branch from 08e1bee to 4d79d68 Compare September 1, 2026 11:14

eshurakov merged commit edaca74 into main Sep 1, 2026
23 of 37 checks passed

eshurakov deleted the eshurakov/eager-hollow branch September 1, 2026 11:41

github-actions Bot mentioned this pull request Sep 2, 2026

docs: auto-sync with merged PRs (through 2026-09-02) Kilo-Org/kilocode#13572

Closed

iscekic mentioned this pull request Sep 9, 2026

feat(provider-review): add server-side GitLab and Bitbucket review layer for mobile (part 1/2) #6006

Merged

Navigation Menu

Repository navigation

feat(cloud-agent-next): contain managed sandbox credentials - #5552

feat(cloud-agent-next): contain managed sandbox credentials#5552
eshurakov merged 3 commits into
eshurakov/glossy-gullfrom
eshurakov/eager-hollow

eshurakov commented Aug 27, 2026 •

edited

Loading

Uh oh!

kilo-code-bot Bot commented Aug 27, 2026 •

edited

Loading

Previous review (commit `08e1bee`)

Executive Summary

Previous review (commit `8ce1f09`)

Previous review (commit `d4c4fe0`)

Previous review (commit `282cec2`)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

eshurakov commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Native PR stack

Verification

Rollout and limits

Uh oh!

kilo-code-bot Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit 08e1bee)

Executive Summary

Previous review (commit 8ce1f09)

Previous review (commit d4c4fe0)

Previous review (commit 282cec2)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eshurakov commented Aug 27, 2026 •

edited

Loading

kilo-code-bot Bot commented Aug 27, 2026 •

edited

Loading

Previous review (commit `08e1bee`)

Previous review (commit `8ce1f09`)

Previous review (commit `d4c4fe0`)

Previous review (commit `282cec2`)