Repository navigation
fix(agent-profiles): restrict organization profile changes to managers - #8086
Conversation
Organization-owned profiles are shared content, so their mutations now require an organization owner or admin role, matching repository binding and repository-bound deletion. Read access stays available to every member. The MCP secret round-trip is bound to an unchanged destination: a stored header or environment value is reused only while the remote URL or local command stays the same, and an update that changes the destination must submit the values again. The web and mobile profile editors render read-only for non-managers.
|
bot: Editor states observed in the local dev stack, with the affected app and a local development organization.
|
70852e6 to
dd6cba5
Compare
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe incremental commit at Assumptions: Files Reviewed (3 files)
Verification Notes
Previous Review Summaries (9 snapshots, latest commit 6573052)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 6573052)Status: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe incremental commit correctly carries the organization-manage capability into the mobile repo-pins section, but it also hides the Profiles list create action for members, which removes the only in-app path to personal-profile creation while an organization is active. Assumptions: Overview
Issue Details (click to expand)WARNING
Files Reviewed (7 files)
Fix these issues in Kilo Cloud Previous review (commit 13a9dfd)Status: No Issues Found | Recommendation: Merge Executive SummarySince the previous review at Assumptions: Files Reviewed (1 file)
Verification Notes
Previous review (commit 6cdb52f)Status: No Issues Found | Recommendation: Merge Executive SummaryThe only change since the previous review is a single deleted blank line in Assumptions: Files Reviewed (1 file)
Verification Notes
Previous review (commit 87cf21e)Status: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change is a test-only refactor: it inlines the overview suite's icon mock, deletes the now-unused icon helper, and shares the per-test reset through Assumptions: Files Reviewed (4 files)
Verification Notes
Previous review (commit d202c1b)Status: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change adds a dedicated read-only mounted suite for the mobile setup-commands screen, and its mocks and expectations match the current screen, helpers, and Assumptions: Files Reviewed (3 files)
Verification Notes
Previous review (commit a084f7c)Status: No Issues Found | Recommendation: Merge Executive SummaryThe incremental commit only adds role-matrix tests around organization profile creation, and those tests match the current router and role constants; the two previously raised MCP findings are verified fixed in current code. Files Reviewed (3 files)
Verification Notes
Previous review (commit 760dee0)Status: No Issues Found | Recommendation: Merge Executive SummaryThe new commit only adds router permission-matrix tests for skills, agents, kilo commands, and instructions; the tests are well-scoped and the previously raised MCP destination and command-comparison findings are verified fixed in current code. Files Reviewed (3 files)
Previous review (commit fa5ef5e)Status: No Issues Found | Recommendation: Merge Executive SummaryThe follow-up commit correctly binds MCP stored values to the transport type and preserves unchanged command arrays in the web editor; no new defects found in the changed lines. Files Reviewed (3 files)
Previous review (commit dd6cba5)Status: 2 Issues Found | Recommendation: Address before merge Executive SummaryThe new MCP destination guard can be bypassed by a server-type change and can falsely block saves of commands the web editor cannot round-trip. Overview
Issue Details (click to expand)WARNING
Files Reviewed (33 files)
Reviewed by deepseek-flash-latest · Input: 47.1K · Output: 3.7K · Cached: 405.9K Review guidance: REVIEW.md from base branch |
A stored value round-trips only when the transport and destination match the stored server. The web editor keeps the stored command array when its text is unchanged, so arguments that contain whitespace still round-trip.
…age-access # Conflicts: # apps/mobile/src/components/profiles/profile-agents-screen.tsx
…age-access # Conflicts: # apps/mobile/src/components/profiles/new-profile-screen.tsx # apps/web/src/components/cloud-agent/profile-editor/ProfilesManager.tsx # apps/web/src/routers/agent-profiles-router.test.ts # apps/web/src/routers/agent-profiles-router.ts
…age-access # Conflicts: # apps/mobile/src/components/profiles/profile-commands-screen.tsx
…age-access # Conflicts: # apps/mobile/src/components/profiles/profile-agents-screen.tsx # apps/mobile/src/components/profiles/profile-commands-screen.tsx # apps/mobile/src/components/profiles/profile-kilo-commands-screen.tsx # apps/mobile/src/components/profiles/profile-mcp-screen.tsx # apps/mobile/src/components/profiles/profile-overview-screen.tsx # apps/mobile/src/components/profiles/profile-skills-screen.tsx # apps/mobile/src/components/profiles/profile-variables-screen.tsx # apps/web/src/routers/agent-profiles-router.ts
…age-access # Conflicts: # apps/mobile/src/components/profiles/profile-overview-screen.tsx # apps/web/src/routers/agent-profiles-router.test.ts
|
bot: Re-ran the end-to-end check on the merged branch head against a local dev stack with an owned fake organization account. Exercised:
Attachments show the observed states. |















Evidence
Evidence: demonstrated — exercised profile views in the Android app and profile requests against the local web API on commit 45e9ffe, using owned test accounts and a disposable local database.
Change
Align organization-owned profile operations and editor controls with organization management permissions. Keep personal profile creation available. Apply destination-specific MCP value handling.
Verification
Proxy answers
The owner's proxy gave these answers in the owner's place.