[eshurakov]

Summary

• Reuse legacy Code Review partial-clone eligibility in control-plane preparation for GitHub, GitLab, and capability-backed Bitbucket, including contained Bitbucket aliases.
• Clone with --filter=blob:none, retry once without the filter on explicit rejection, and inspect remote.origin.promisor before reporting blobless success. Log clone mode, attempts, and duration without repository URLs or credentials.
• Skip the discarded default-branch checkout for synthetic review refs, then fetch and check out the requested review ref directly.
• Apply the existing invocation-scoped managed GitHub authentication and redirect safeguards to review checkouts so implicit lazy blob fetches remain authenticated.
• Preserve full history, branch refs, tags, non-review clone arguments, and the six-minute shared clone/checkout budget. No shallow or single-branch clones, timeout increase, schema change, or deployment.

Motivation

The production handoff identified clone timeouts as 25 of 34 remaining platform failures after the disk-capacity fix. The control-plane path still fetched historical blobs, unlike the legacy Code Review path. This reduces fetched data rather than extending how long users wait for a genuine failure.

Verification

• pnpm --filter cloud-agent-next run test: 223 files passed; 6,816 tests passed, 3 skipped.
• Affected wrapper files: 215 tests passed (prepare.test.ts and session-bootstrap.test.ts), including filter rejection/fallback, ignored filters, platform/origin/capability gating, synthetic-ref checkout, retry behavior, and shared-deadline abort classification.
• Real Git smart-HTTP/proxy tests: 7 passed, including authenticated lazy checkout for ordinary and synthetic review branches and rejection of same-origin, cross-origin, alternate-port, and downgrade redirects.
• pnpm --filter cloud-agent-next run typecheck: passed.
• pnpm --filter cloud-agent-next run lint: passed; final changed-file lint also passed.
• Changed-file pnpm format and git diff --check: passed.
• Full test:wrapper exceeded the sandbox command limit of 210 seconds. It reported two deadline-sensitive bootstrap failures that passed on isolated rerun, plus main-cert-refusal.test.ts, which also fails in isolation: this sandbox has the Cloudflare CA file that the test assumes is absent.

Rollout

Not deployed. After deployment, compare Code Review platform-failed share and source_control_clone_timeout/sandbox_capacity in agent-health, and inspect the new clone-mode/duration logs. Retain the current failure deadline.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	115	docs/control-plane.md still documents proactiveAuth/followRedirects as clone/fetch-only, but this PR also applies them to review checkouts

Files Reviewed (4 files)

• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts - 1 suggestion
• services/cloud-agent-next/wrapper/src/session-bootstrap.ts - no issues
• services/cloud-agent-next/test/unit/managed-github-preparation-auth.test.ts - no issues
• services/cloud-agent-next/wrapper/src/control-plane/prepare.test.ts - no issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 410.6K · Output: 64.6K · Cached: 4.6M}

_{Review guidance: REVIEW.md from base branch main}