[iscekic]

Evidence

Evidence: demonstrated — a local end-to-end run delivered signed GitHub chat webhooks into the running app, which executed the real bot agent loop and tool against Postgres, the GitLab credential broker and the Cloud Agent client; each scenario's tool result, prepared-session payload and provider read was observed.

Change

The bot's Cloud Agent tool resolves a requested GitLab project through the account's GitLab connection before it prepares a session, matching how its GitHub branch resolves a repository. Organization connections resolve through the acting bot user; personal connections resolve through their owner. The tool answers with its error and prepares no session unless the requested project is in the connection's project set. A lookup that cannot complete answers with a retryable message. Lookup failures are reported to Sentry under the tool's operation tag.

This pull request is bot-tool-scoped. The sibling router path is tracked separately; web, mobile and CLI behavior is outside this pull request.

Verification

End-to-end run on the work VM at head a357422. Real Next.js dev server, real Postgres, real /api/webhooks/github route, real bot agent loop with real tool execution, real GitLab integration helpers. The chat platform, the GitLab API, the GitLab credential broker and the Cloud Agent API were served by one local recorder at the network boundary.

Four signed issue_comment webhooks, one per scenario; each checked against the app's bot_requests row and the recorder's request log:

Scenario	Tool result	Cloud Agent prepare calls	Provider read
Project in the connection's set	session started	1, with that project's clone URL, platform and organization	none (cached set)
Project outside the set	not available through this account's GitLab integration	0	none
In-set project, no cached set	session started	1	GET /api/v4/projects, snapshot persisted
Provider read fails	could not verify access, please try again	0	GET /api/v4/projects refused

12 of 12 checks passed. The GitHub thread received the bot reply in the refused and retry cases.

Also at this head:

• pnpm --filter web test -- spawn-cloud-agent-session — 10 passed.
• 54 head checks green; kilobot reviewed the head with no findings; no unresolved review threads.

Not exercised: a live GitLab account, a real chat workspace and a real worker clone. This is a nonvisual change; no screenshot is provided.

Production prerequisites

None.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: How wide should the GitLab project check be?
   Answer: Bot tool only.
   Confidence: 0.62 · Precedent: The least work without a drop in quality; close a related gap if the session finds one.
2. Question: The existing project validators raise an error when the connection's project set cannot be read. What should the tool do then?
   Answer: Fail closed with a retry message.
   Confidence: 0.75 · Precedent: Keep the file's error-string convention and do not report a transient outage as a permanent verdict.
3. Question: How should the sibling router path be handled?
   Answer: Keep this pull request scoped to the bot tool. Handle the router path in a separate pull request with tests and end-to-end proof, written in neutral text.
   Confidence: 0.55 · Precedent: Fix the class on every affected surface, with each concern in its own pull request.
4. Question: Publication and completion checks were blocked by repeated shared-judge HTTP 429 responses while a dedicated credential was already configured. May the local provider use that credential for these checks and then restore the original configuration?
   Answer: Temporarily use the judge credential.
   Confidence: 0.78 · Precedent: Approve narrowly scoped operational recovery; do not accept blocked as an end state.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The bot's Cloud Agent tool now resolves GitLab projects through the account connection before preparing a session; the added validation, error handling, and tests are consistent with the existing GitHub path and I found no defects in the changed code.

Files Reviewed (2 files)

• apps/web/src/lib/bot/tools/spawn-cloud-agent-session.ts - resolves project via validateGitLabRepoAccessForOrganization/validateGitLabRepoAccessForUser; fails closed on lookup error and rejects uncovered projects before token resolution; matches helper signatures and owner semantics
• apps/web/src/lib/bot/tools/spawn-cloud-agent-session.test.ts - covers personal/org resolution, uncovered project, and lookup failure

---

_{Reviewed by deepseek-v4.1-flash · Input: 44.3K · Output: 5.4K · Cached: 336.5K}

_{Review guidance: REVIEW.md from base branch main}

[eshurakov]

Shallow review: no critical issues found.