[eshurakov]

Standardizes Cloud Agent execution on the existing runtime credential proxy across both session planes. Removes retired credential adapters and unused Worker-side workspace preparation.

Sessions that require an upgrade receive recovery guidance. Session reads, Stop, deletion, and managed Git credential handling remain supported. No data migration is needed.

Validation on the updated main base:

• Cloud Agent unit suite: 7,161 passed, 3 skipped.
• Workers integration suite: 854 passed across 44 files.
• Service and wrapper typechecks passed.
• PR-file lint, formatting, conflict-marker scan, and diff checks passed.

Real provider deployment was not exercised.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The runtime-credential standardization is internally consistent: legacy grants stay readable through a compatibility schema, execution paths fail closed with credential_upgrade_required, and no native Kilo token is projected into the sandbox. I found no new defects in the changed production code.

Assumptions: [INFERENCE] The branch history was rebased, so the previous review SHA is not an ancestor of HEAD and the prior incremental-diff command did not isolate the new change; I reviewed the full PR diff (gh pr diff 8169) against 37ef233d. Verification was read-only: scanner, lint, typecheck, and tests were not re-run. The test-only module-level preparedIdentities map in test/integration/sandbox-control-v2-repo-snapshots.test.ts accumulates entries across a test file but has no production impact.

Files Reviewed (12 production files)

• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/scripts/duplication-allowlist.json
• services/cloud-agent-next/src/control-plane/sandbox/routes.ts
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts
• services/cloud-agent-next/src/control-plane/sandbox/scope-grants.ts
• services/cloud-agent-next/src/control-plane/session/failure-messages.ts
• services/cloud-agent-next/src/control-plane/session/registration.ts
• services/cloud-agent-next/src/sandbox-control/session-credentials.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/shared/control-plane-protocol.ts
• services/cloud-agent-next/src/shared/credential-upgrade.ts
• services/cloud-agent-next/src/telemetry/control-plane-failure.ts

Tests, e2e README, and wrangler.test.jsonc were reviewed for behavior coverage; no comments warranted on changed lines.

Previous Review Summaries (6 snapshots, latest commit 3b5ff3a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3b5ff3a)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only change since the last review deletes the now-stale self-file duplication exception for session-service.ts; the duplicated buildContext projection it covered was removed with the legacy sandbox preparation path, leaving a single call, so the allowlist stays consistent with the ratchet. No new defects or resource leaks in the changed lines.

Verification: read-only review of 3b5ff3ae; scanner/lint/tests were not re-run.

Files Reviewed (1 file)

• services/cloud-agent-next/scripts/duplication-allowlist.json - 0 issues

Previous review (commit 6338ca8)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The installed head keeps the previously reviewed credential-retirement changes plus the documentation corrections from the earlier round: persisted legacy grants now read through a compatibility schema, upgrade failures reach route reasons and user message text, and the changed lines add no new defect or leak-prone resources.

Verification: read-only review of 6338ca8d; the PR's tests and typechecks were not independently re-run.

Files Reviewed (34 files)

• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/src/control-plane/sandbox/routes.ts
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts
• services/cloud-agent-next/src/control-plane/sandbox/scope-grants.ts
• services/cloud-agent-next/src/control-plane/session/failure-messages.ts
• services/cloud-agent-next/src/control-plane/session/registration.ts
• services/cloud-agent-next/src/control-plane/session/registration.test.ts
• services/cloud-agent-next/src/sandbox-control/session-credentials.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session/agent-runtime.test.ts
• services/cloud-agent-next/src/session/control-plane-session-input.test.ts
• services/cloud-agent-next/src/shared/control-plane-protocol.ts
• services/cloud-agent-next/src/shared/credential-upgrade.ts
• services/cloud-agent-next/src/telemetry/control-plane-failure.ts
• services/cloud-agent-next/test/e2e/README.md
• services/cloud-agent-next/test/integration/control-plane-session-v2-interactions.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-management.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-reports.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-rpc.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-transport.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-status-badge-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-terminal-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-worktree-changes-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-worktree-deletion-v2.test.ts
• services/cloud-agent-next/test/integration/helpers/fake-credentials.ts
• services/cloud-agent-next/test/integration/helpers/fake-session-peer.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-credentials.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-repo-snapshots.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-routes.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2.test.ts
• services/cloud-agent-next/test/integration/sandbox-runtime-startup.test.ts
• services/cloud-agent-next/wrangler.test.jsonc

Previous review (commit ae1bc08)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit completes the retirement of the legacy Kilo broker/direct-token paths: every session now requires modern runtime authorization, persisted legacy grants stay readable for inspection and cleanup, route preparation and warm delivery fail closed with credential_upgrade_required, and the previous review's findings remain addressed. No new defects were found in the changed lines.

Files Reviewed (27 files)

• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts
• services/cloud-agent-next/src/control-plane/session/registration.ts
• services/cloud-agent-next/src/control-plane/session/registration.test.ts
• services/cloud-agent-next/src/sandbox-control/session-credentials.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session/agent-runtime.test.ts
• services/cloud-agent-next/src/session/control-plane-session-input.test.ts
• services/cloud-agent-next/test/e2e/README.md
• services/cloud-agent-next/test/integration/helpers/fake-credentials.ts
• services/cloud-agent-next/test/integration/helpers/fake-session-peer.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-interactions.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-management.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-reports.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-rpc.test.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2-transport.test.ts
• services/cloud-agent-next/test/integration/control-plane-status-badge-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-terminal-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-worktree-changes-v2.test.ts
• services/cloud-agent-next/test/integration/control-plane-worktree-deletion-v2.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-credentials.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-repo-snapshots.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-routes.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2.test.ts
• services/cloud-agent-next/wrangler.test.jsonc

Verification notes: read-only review of ae1bc08c; no commands were executed beyond read-only git/gh inspection, so the PR's own test/typecheck results were not independently reproduced.

Previous review (commit c2d4c2b)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental follow-up propagates the new credential_upgrade_required failure reason consistently through route failure, message settlement, callbacks, diagnostics, and telemetry, with no new correctness, compatibility, or security issues found in the changed lines.

Files Reviewed (10 files)

• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/src/control-plane/sandbox/routes.ts
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts
• services/cloud-agent-next/src/control-plane/session/failure-messages.ts
• services/cloud-agent-next/src/sandbox-control/session-credentials.ts
• services/cloud-agent-next/src/shared/control-plane-protocol.ts
• services/cloud-agent-next/src/shared/credential-upgrade.ts
• services/cloud-agent-next/src/telemetry/control-plane-failure.ts
• services/cloud-agent-next/test/integration/control-plane-session-v2.test.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-credentials.test.ts

Previous review (commit 4afc241)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up makes persisted containment-off grants readable through a permissive read schema, keeps issuance strict, excludes unusable grants from provider policy, and fails such routes with the credential_upgrade_required stage; the previously reported persistence, GitLab documentation, and user-visible-message findings are addressed.

Files Reviewed (5 files)

• services/cloud-agent-next/docs/control-plane.md
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts
• services/cloud-agent-next/src/control-plane/sandbox/scope-grants.ts
• services/cloud-agent-next/src/sandbox-control/session-credentials.ts
• services/cloud-agent-next/test/integration/sandbox-control-v2-credentials.test.ts

Previous review (commit 1bdfa5c)

Status: 3 Issues Found | Recommendation: Address before merge

Executive Summary

The strict new containment-off grant invariant also applies to persisted grants, so previously written grants fail to parse and can break unrelated Sandbox DO operations instead of producing the documented credential-upgrade failure.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/sandbox-control/session-credentials.ts	225	New uncontained-grant rule retroactively invalidates stored containmentEnabled: false grants, which readScopeGrant/listScopeGrants parse on read

SUGGESTION

File	Line	Issue
services/cloud-agent-next/docs/control-plane.md	867	Containment list omits GitLab, which hasCredentialContainment also treats as contained
services/cloud-agent-next/docs/control-plane.md	878	Control-plane route failures surface only Workspace setup failed, not upgrade guidance

Files Reviewed (11 files)

• services/cloud-agent-next/docs/control-plane.md - 2 issues
• services/cloud-agent-next/src/control-plane/sandbox/routes.ts - no issues
• services/cloud-agent-next/src/control-plane/session/registration.test.ts - no issues
• services/cloud-agent-next/src/control-plane/session/registration.ts - no issues
• services/cloud-agent-next/src/sandbox-control/session-credentials.ts - 1 issue
• services/cloud-agent-next/src/session-service.test.ts - no issues
• services/cloud-agent-next/src/session-service.ts - no issues
• services/cloud-agent-next/src/session/agent-runtime.test.ts - no issues
• services/cloud-agent-next/test/e2e/README.md - no issues
• services/cloud-agent-next/test/integration/sandbox-control-v2-credentials.test.ts - no issues
• services/cloud-agent-next/test/integration/sandbox-control-v2.test.ts - no issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-flash-latest · Input: 379K · Output: 27.7K · Cached: 5.9M}

_{Review guidance: REVIEW.md from base branch main}