[eshurakov]

Warning

Do not merge or deploy this PR alone. Merge it together with #7491. cloud-agent-next deploys from main on a schedule, and the container image ships in the same wrangler deploy as the Worker. With the current Worker, this wrapper puts the per-session proxy handles of one directory into one Kilo process, and each handle overwrites the other.

Summary

Part 2 of 3 in a stack. Base: #7489.

1. feat(session-ingest): accept worktree-scoped Cloud Agent requests #7489: session-ingest accepts worktree-scoped requests.
2. This PR: wrapper, one Kilo runtime per directory.
3. feat(cloud-agent-next): share one scoped credential per worktree #7491: Worker, one scoped credential per worktree.

• The wrapper runs one Kilo runtime per checkout directory. It accepts the deprecated runtimeIsolation field and ignores it. HOME is sha256(scopeId + "\0" + directory), so chats in one worktree share one HOME, and two worktrees or two directories do not.
• A shared runtime holds one credential class. A route fails when its credential class (proxy handle or legacy alias) or its MCP configuration is different from the warm runtime. It does not run with the credentials or servers of another session.
• When a route is released, the wrapper aborts the Kilo session tree of that route with a bounded walk (kilo-api.ts). A deleted chat now stops at once. Before, it ran until it was idle.
• The main.ts dispatcher is extracted, so directory-key-flip.test.ts can drive it.
• src/shared/runtime-credential-proxy-handle.ts holds the handle audience. The Worker in feat(cloud-agent-next): share one scoped credential per worktree #7491 also uses it.

Verification

• No manual tests. This layer is not safe to run without feat(cloud-agent-next): share one scoped credential per worktree #7491, and I did not run the full stack on a local or deployed sandbox.

Visual Changes

N/A

Reviewer Notes

• Merge order: merge feat(session-ingest): accept worktree-scoped Cloud Agent requests #7489 first. Then merge feat(cloud-agent-next): share one scoped credential per worktree #7491 into this branch, and merge this PR into main in one step. Finish the drain (rollout step 3 in docs/control-plane.md) before that merge, because the scheduled production deploy ships it.
• Local checks on this layer: cloud-agent-next typecheck (Worker and wrapper), unit tests (6,329 pass), wrapper tests (1,185 pass, 0 fail), oxlint and oxfmt.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The previous review SHA (abce037a…) is absent from this repo, so I fell back to a full review of the whole PR at HEAD (cec0e959…) across 14 files; I found no new high-confidence issue, no memory leak, and the two prior threads are addressed by the author's stack context.

Notes

• Both existing inline threads are resolved by author replies: runtimeKey (and homeKey) in prepare.ts still honor runtimeIsolation, and secret-bearing/profile/MCP/modern-auth routes are still forced to per-session at registration.ts:286-292, so a sibling shared-HOME cannot receive another session's secrets or profile. The unconditional materializeRuntimeProfile call only ever runs with the inherited profile for a shared route, so it cannot clobber a differently-profiled sibling.
• Memory-leak check on the changed code: the new release cleanup is bounded by deadline (10s), max depth (8) and max node count (64); its abort listener and timer are removed in finally; releaseCleanups entries are deleted when their promise settles; and preparing entries are removed by finalizePreparingOwner in every prepare branch. No unbounded map/listener/timer growth found.
• No .md documentation files were changed, so the markdown image-format rule does not apply.

Files Reviewed (14 files)

• services/cloud-agent-next/src/shared/runtime-credential-proxy-handle.ts
• services/cloud-agent-next/wrapper/src/control-plane/directory-key-flip.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.ts
• services/cloud-agent-next/wrapper/src/control-plane/main.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare-adopt-git.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts
• services/cloud-agent-next/wrapper/src/control-plane/turn.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/turn.ts
• services/cloud-agent-next/wrapper/src/control/delete-worktree.ts
• services/cloud-agent-next/wrapper/src/control/session-child-schema.ts
• services/cloud-agent-next/wrapper/src/kilo-api.test.ts
• services/cloud-agent-next/wrapper/src/kilo-api.ts

Previous Review Summaries (2 snapshots, latest commit abce037)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit abce037)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Fallback to a full review: the previous review SHA (7b3e03c…) is not present in this repository, so I reviewed the complete PR diff at HEAD (abce037a) across 14 files; both prior findings were re-verified and do not reproduce, and no new high-confidence issue was found. runtimeKey (and homeKey) are unchanged by this PR and still honor runtimeIsolation, and every profile/secret/MCP/modern-auth route is forced to per-session at registration (registration.ts:289-294), so the now-unconditional materializeRuntimeProfile has no sibling shared HOME to clobber at HEAD. No unbounded map/listener/timer growth (memory leak) was found in the changed code: the new release-cleanup path is bounded by deadline, max depth and max node count, its abort listener and timer are removed in finally, and releaseCleanups entries are deleted when their promise settles.

Notes on the two prior findings

• runtimeKey / per-session isolation (was CRITICAL): not reproducible. export function runtimeKey is a context line in this PR (only a doc comment was added above it); its body still returns spec.sessionId when runtimeIsolation === 'per-session', and secret/profile/MCP/modern-auth routes are all forced to per-session before the frame reaches the wrapper. No change drops that isolation in this PR.
• Unconditional materializeRuntimeProfile (was WARNING, line 1291): already tracked by an active inline comment with the author's reply; a route that carries runtimeSkills/runtimeAgents/kiloCommands is per-session keyed, so it materializes into its own HOME and cannot rewrite a non-profile sibling's shared HOME.

Files Reviewed (14 files)

• services/cloud-agent-next/src/shared/runtime-credential-proxy-handle.ts
• services/cloud-agent-next/wrapper/src/control-plane/directory-key-flip.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.ts
• services/cloud-agent-next/wrapper/src/control-plane/main.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare-adopt-git.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts
• services/cloud-agent-next/wrapper/src/control-plane/turn.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/turn.ts
• services/cloud-agent-next/wrapper/src/control/delete-worktree.ts
• services/cloud-agent-next/wrapper/src/control/session-child-schema.ts
• services/cloud-agent-next/wrapper/src/kilo-api.test.ts
• services/cloud-agent-next/wrapper/src/kilo-api.ts

Previous review (commit 7b3e03c)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

Keying every wrapper runtime by checkout directory silently drops the Worker's forced per-session isolation, so an env/secret-bearing route can share a warm runtime (and its environment) with a sibling in the same directory; the now-unconditional runtime-profile materialization can additionally clobber a sibling's shared HOME. No unbounded map/listener/timer growth (memory leak) was found in the changed code.

Overview

Severity	Count
CRITICAL	1
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	279	runtimeKey ignores runtimeIsolation; a sibling route can reuse a runtime whose env holds another session's decrypted secrets

WARNING

File	Line	Issue
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	1297	Unconditional materializeRuntimeProfile can wipe skills/profile.json in a sibling's shared HOME

Files Reviewed (15 files)

• services/cloud-agent-next/src/shared/runtime-credential-proxy-handle.ts
• services/cloud-agent-next/wrapper/src/control-plane/directory-key-flip.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/kilo-runtime.ts
• services/cloud-agent-next/wrapper/src/control-plane/main.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare-adopt-git.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts - 2 issues
• services/cloud-agent-next/wrapper/src/control-plane/terminals.ts
• services/cloud-agent-next/wrapper/src/control-plane/turn.test.ts
• services/cloud-agent-next/wrapper/src/control-plane/turn.ts
• services/cloud-agent-next/wrapper/src/control/delete-worktree.ts
• services/cloud-agent-next/wrapper/src/control/session-child-schema.ts
• services/cloud-agent-next/wrapper/src/kilo-api.test.ts
• services/cloud-agent-next/wrapper/src/kilo-api.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 110.5K · Output: 26.8K · Cached: 2.1M}

_{Review guidance: REVIEW.md from base branch main}