[eshurakov]

Summary

Part 1 of 3 in a stack that splits the change "share worktree runtimes with scoped credentials":

1. This PR: session-ingest accepts worktree-scoped requests.
2. feat(cloud-agent-next): key wrapper Kilo runtimes by directory #7490: wrapper, one Kilo runtime per directory.
3. feat(cloud-agent-next): share one scoped credential per worktree #7491: Worker, one scoped credential per worktree.

The Cloud Agent session-scope receiver now accepts a v2 scope assertion. The v2 headers name a worktree, the expected organization and the member root Kilo sessions (at most 32 roots, and at most 4096 bytes for the header block). One handle can then serve every session in the member trees of that worktree.

• Create and ingest accept v1 and v2. The v1 path keeps its behavior.
• The new export and title routes accept only v2.
• The reported-title write moves to services/session-title.ts, so the public route and the scoped route use the same code.

This PR can deploy alone. It is step 1 of the rollout in services/cloud-agent-next/docs/control-plane.md: session-ingest must accept v2 before the Worker sends it. No caller sends v2 headers before #7491.

Verification

• No manual tests. No caller sends v2 headers until feat(cloud-agent-next): share one scoped credential per worktree #7491 ships, so there is no path to test by hand.

Visual Changes

N/A

Reviewer Notes

• Local checks: session-ingest typecheck, unit tests (1,309 pass) and integration tests (100 pass), contracts typecheck, oxlint and oxfmt.
• The scoped export route uses the SessionExportResult API from feat(session-ingest): clone and export a session up to a message #7439.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/session-ingest/package.json	10	New test:postgres suite is not invoked by any CI job

Files Reviewed (12 files)

• packages/session-ingest-contracts/src/cloud-agent-worktree-scope.ts
• packages/session-ingest-contracts/src/index.ts
• services/session-ingest/package.json - 1 issue
• services/session-ingest/src/routes/api.ts
• services/session-ingest/src/routes/cloud-agent-session-scope.test.ts
• services/session-ingest/src/routes/cloud-agent-session-scope.ts
• services/session-ingest/src/services/cloud-agent-worktree-scope.test.ts
• services/session-ingest/src/services/cloud-agent-worktree-scope.ts
• services/session-ingest/src/services/session-title.ts
• services/session-ingest/test/postgres/cloud-agent-worktree-scope.test.ts
• services/session-ingest/tsconfig.json
• services/session-ingest/vitest.postgres.config.ts

Fix these issues in Kilo Cloud

Previous Review Summary (commit d4ac6bf)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit d4ac6bf)

Status: No Issues Found | Recommendation: Merge

Executive Summary

I reviewed the 8-file v2 worktree-scope change across the contracts, the session-ingest route/service layer, and its tests, and found no high-confidence bugs or security gaps; the v2 authorization fails closed and consistently scopes every lookup by owner, organization, and worktree.

Files Reviewed (8 files)

• packages/session-ingest-contracts/src/cloud-agent-worktree-scope.ts
• packages/session-ingest-contracts/src/index.ts
• services/session-ingest/src/routes/api.ts
• services/session-ingest/src/routes/cloud-agent-session-scope.test.ts
• services/session-ingest/src/routes/cloud-agent-session-scope.ts
• services/session-ingest/src/services/cloud-agent-worktree-scope.test.ts
• services/session-ingest/src/services/cloud-agent-worktree-scope.ts
• services/session-ingest/src/services/session-title.ts

Notes / assumptions:

• The v2 create/ingest paths gate on hasOrganizationAccess (or organization_id IS NULL for the personal sentinel) and every session/parent lookup is scoped by kilo_user_id, organization, and cloud_agent_worktree_id, so the asserted member roots are a consistency check within a tenant rather than a cross-tenant boundary; no authorization bypass was reproducible.
• The ancestry walk is bounded by both a visited set and a 32-hop cap and fails closed on dangling parents/cycles.
• The extracted applyReportedSessionTitle preserves the public title route's behavior (read, default-title guard, CAS write, preserved updated_at).
• Related stack PRs feat(cloud-agent-next): key wrapper Kilo runtimes by directory #7490/feat(cloud-agent-next): share one scoped credential per worktree #7491 (the v2 senders) are not present in this worktree, so the v2 wire contract was verified against the header codec and the in-repo proxy only.

---

_{Reviewed by deepseek-v4.1-flash · Input: 269.8K · Output: 37.4K · Cached: 2.6M}

_{Review guidance: REVIEW.md from base branch main}