Skip to content

build(cloud-agent): upgrade container dependencies - #8298

Merged
eshurakov merged 1 commit into
mainfrom
kilo/smooth-beacon-p1p
Oct 21, 2026
Merged

build(cloud-agent): upgrade container dependencies#8298
eshurakov merged 1 commit into
mainfrom
kilo/smooth-beacon-p1p

Conversation

@eshurakov

@eshurakov eshurakov commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Upgrade all five Cloud Agent Dockerfiles to Kilo CLI 7.8.15, Bun 1.3.14, pnpm 12.14.0, glab 1.124.0, gh 2.102.0, and Node 24.22.0 where pinned.
  • Upgrade Cloudflare Sandbox images and SDK to 0.12.12; synchronize Kilo SDK pins, Wrangler image build variables, runtime contracts, and the lockfile.
  • Explicitly replace inherited Node/npm in the Sandbox-based images and download pinned GitHub CLI releases rather than relying on apt freshness.
  • Regenerate the slash-command catalog with CLI 7.8.15 and synchronize the mobile English goal description.
  • Extend version-parity coverage to every Dockerfile, including the runtime-free recipe.

Compatibility

  • Keep Node on the repository-required 24.x line rather than upgrading to Node 26.
  • Keep Sandbox on the latest compatible 0.12.x patch. Sandbox 1.x requires a separate architectural migration.
  • Add an exact-version minimumReleaseAge exception for @cloudflare/sandbox@0.12.12.
  • The repository package manager remains pnpm 11.1.2; pnpm 12.14.0 is the container toolchain pin.

Local Smoke Findings

  • The initial build exposed inherited Node 22.23.3 and a stale gh 2.4.0 after the GitHub apt index failed to refresh. Explicit pins now prevent both cases.
  • Replacing npm requires removing its inherited directory first: overlaying npm 11 onto npm 10 leaves incompatible bundled modules. The corrected image installs successfully.

Verification

  • 98 focused tests passed across sandbox-image-versions, slash-commands, runtime-manifest, runtime-base, vercel-snapshot, and vercel-agent-sandbox.
  • Cloud Agent and wrapper TypeScript checks passed against upgraded SDKs; targeted lint, formatting, frozen-lockfile install, and git diff --check passed.
  • Started the local eight-service stack and rebuilt all eight configured development container images (Dockerfile.dev, Dockerfile.dind, and Dockerfile.containers).
  • Cold/warm smoke passed in 51.6 seconds through the real Worker, Durable Object, native Cloudflare container, wrapper, and CLI, with fake inference: exact initial response dependency-smoke followed by three completed warm turns, with the same physical container retained.
  • Verified the exercised container reports Node 24.22.0, npm 11.19.1, Bun 1.4.3, pnpm 12.14.0, Kilo 7.8.15, gh 2.102.0, and glab 1.124.0. Its control-plane wrapper SHA-256 matches the rebuilt Sandbox image: 0bf77e52a91623b89feb2667b18590c5da63bd75a28532abd1bc0fee771f128f.
  • SDK harness setup now supplies the local internal API key; public SDK calls remain bearer-only. Admission, warm SDK transcript reads, isolated-container stop, cold session reads and cold transcript pagination pass. The full SDK acceptance run still fails waiting for cloud.message.queued on the scoped SSE stream. The control-plane source has no publishCloudAgentExtensionEvent call; that publication exists in the legacy CloudAgentSession path. No full SDK acceptance claim is made.
  • Harness compatibility fixes use current root-session ownership discovery, retain strict sibling/listener cleanup checks for isolated /workspace/app containers, and bound retries of KILO_SESSION_SNAPSHOT_PENDING to 30 seconds.
  • All 607 tests passed across test/unit/e2e and middleware balance tests after these fixes; Cloud Agent typecheck, targeted lint, formatting and diff checks passed.
  • The production-only Dockerfile and runtime-free recipe were not independently built. No real-model or browser-chat coverage; no deployment performed.

Bun Version Follow-up

  • Retain Bun and wrapper @types/bun at 1.3.14 across all five Dockerfiles, the runtime contract, fixtures, and lockfile. Other toolchain upgrades are unchanged.
  • On Bun 1.3.14: all five wrapper bundles built successfully; wrapper typecheck, 65 focused runtime/version tests, targeted lint, formatting, frozen-lockfile installation, and git diff --check passed.
  • The broader wrapper test run encountered a timeout in main-cert-refusal.test.ts (child did not exit within 12 seconds), then exceeded the 120-second command limit. It is not claimed passing.
  • Container cold/warm smoke results above were collected before this follow-up with Bun 1.4.3. Container images and cold/warm smoke were not rerun for the final Bun 1.3.14 combination.

@socket-security

socket-security Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​kilocode/​sdk@​7.8.1 ⏵ 7.8.15100 +110076 +1100100
Updatednpm/​@​cloudflare/​sandbox@​0.12.9 ⏵ 0.12.12100100100 +199100

View full report

kilo-code-bot[bot]
kilo-code-bot Bot reviewed Oct 20, 2026
View reviewed changes
Comment thread services/cloud-agent-next/Dockerfile Resolved
@kilo-code-bot

kilo-code-bot Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up replaces the hard-coded Kilo 7.8.1 assertions with the shared KILO_CLI_VERSION pin across the real-binary fixtures, acceptance driver, and README, and the import paths and version parity hold at HEAD.

Files Reviewed (10 files)
  • services/cloud-agent-next/test/e2e/README.md - no issues; documentation now points at the 7.8.15 binary and the shared pin
  • services/cloud-agent-next/test/e2e/supervision-local.ts - no issues; relative import resolves to src/shared/kilo-cli-version.ts and both the version assertion and evidence record use the pin
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-activity-fixture.ts - no issues; fixture guard compares against KILO_CLI_VERSION and reports the expected value
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-activity.real.test.ts - no issues; suite name only
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-health.real.test.ts - no issues; both binary and health-endpoint version assertions follow the pin
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-intake.real.test.ts - no issues; both version checks updated consistently
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-permission.real.test.ts - no issues; suite name only
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-server-auth.real.test.ts - no issues
  • services/cloud-agent-next/wrapper/src/control-plane/kilo-supervision-fixture.real.test.ts - no issues; suite name only
  • services/cloud-agent-next/wrapper/src/control/workload-isolation.real.test.ts - no issues; assertion and guidance comment follow the pin

The earlier Bun @types/bun drift is also resolved: wrapper/package.json and RUNTIME_DISTRIBUTION.bun are both at 1.3.14, matching every Dockerfile pin.

No runtime application code path changed in this increment, so no new memory-leak surface was introduced. Verification gap: the real-binary suites require an external 7.8.15 binary and were not executed here.

Previous Review Summaries (6 snapshots, latest commit af6dedd)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit af6dedd)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The toolchain pins are synchronized across Dockerfiles, the runtime contract, fixtures, and the lockfile; the only actionable gap is the wrapper's real-binary suites, which still hard-fail unless kilo --version reports 7.8.1.

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 1
Issue Details (click to expand)

SUGGESTION

File Line Issue
services/cloud-agent-next/src/shared/kilo-cli-version.ts 1 kilo-activity-fixture.ts:38, kilo-intake.real.test.ts:14/91, kilo-server-auth.real.test.ts:32, workload-isolation.real.test.ts:104, and test/e2e/supervision-local.ts:116 still require Kilo 7.8.1, so they fail or throw against the 7.8.15 image this PR ships
Files Reviewed (22 files)
  • apps/mobile/src/components/agents/chat-composer-slash-commands.test.ts - no issues
  • apps/mobile/src/i18n/locales/en.json - no issues; English description synchronized with the regenerated catalog
  • apps/mobile/src/lib/minimum-release-age-policy.test.ts - no issues; ordering matches the new pnpm-workspace.yaml entry
  • pnpm-lock.yaml - generated; sandbox 0.12.12 and SDK 7.8.15 entries consistent
  • pnpm-workspace.yaml - no issues; exact-version exemption only
  • services/cloud-agent-next/Dockerfile - no issues; Node/npm replacement layers, gh tarball, Bun pin consistent
  • services/cloud-agent-next/Dockerfile.containers - no issues; version pins aligned with the contract
  • services/cloud-agent-next/Dockerfile.containers.runtime-free - no issues; Node 24.22.0 and gh tarball parity hold
  • services/cloud-agent-next/Dockerfile.dev - no issues; libatomic1 added for the copied Node binary
  • services/cloud-agent-next/Dockerfile.dind - no issues; sandbox 0.12.12 and gh tarball pins aligned
  • services/cloud-agent-next/package.json - no issues
  • services/cloud-agent-next/scripts/runtime-handoff.test.ts - no issues; derives expectation from KILO_CLI_VERSION
  • services/cloud-agent-next/scripts/runtime-manifest.test.ts - no issues
  • services/cloud-agent-next/src/sandbox-image-versions.test.ts - no issues; new parity assertions cover every Dockerfile and wrapper @types/bun
  • services/cloud-agent-next/src/shared/default-slash-commands.generated.ts - no issues
  • services/cloud-agent-next/src/shared/kilo-cli-version.ts - 1 suggestion
  • services/cloud-agent-next/src/shared/runtime-distribution.ts - no issues
  • services/cloud-agent-next/test/e2e/sandbox-control.ts - no issues; /workspace/app is still gated on exclusive siblings and listeners
  • services/cloud-agent-next/test/e2e/sdk-basic-chat.ts - no issues; cleanup passes the root Kilo session and bounded snapshot retry
  • services/cloud-agent-next/test/unit/e2e/sandbox-control-cleanup.test.ts - no issues
  • services/cloud-agent-next/wrangler.jsonc - no issues; all 16 KILOCODE_CLI_VERSION occurrences match the contract
  • services/cloud-agent-next/wrapper/package.json - no issues; SDK and @types/bun aligned with the runtime

No runtime application code paths changed, so this PR adds no new memory-leak surface. Verification gaps: the Dockerfile-image builds and cold/warm smoke were not re-run for the final Bun 1.3.14 combination, and the production-only Dockerfile and runtime-free recipe were not built.

Fix these issues in Kilo Cloud

Previous review (commit f7ca0a5)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The final commit consistently reverts Bun to the base-branch 1.3.14 pin across all five Dockerfiles, RUNTIME_DISTRIBUTION, wrapper @types/bun, fixtures, and the lockfile, so the wrapper typings once again match the container runtime.

Files Reviewed (12 files)
  • pnpm-lock.yaml - no issues; the @types/bun@1.4.3 / bun-types@1.4.3 package and snapshot entries are removed and the services/cloud-agent-next/wrapper importer points back at 1.3.14; only the unrelated cjs-module-lexer@1.4.3 entries contain that version string
  • services/cloud-agent-next/Dockerfile - no issues; BUN_VERSION back to 1.3.14, matching the base branch
  • services/cloud-agent-next/Dockerfile.containers - no issues; BUN_VERSION back to 1.3.14
  • services/cloud-agent-next/Dockerfile.containers.runtime-free - no issues; BUN_VERSION back to 1.3.14
  • services/cloud-agent-next/Dockerfile.dev - no issues; BUN_VERSION back to 1.3.14
  • services/cloud-agent-next/Dockerfile.dind - no issues; BUN_VERSION back to 1.3.14
  • services/cloud-agent-next/scripts/runtime-manifest.test.ts - no issues; contract expectation and the generated verification-script assertion both track 1.3.14
  • services/cloud-agent-next/scripts/vercel-snapshot.test.ts - no issues; fixture matches the pinned runtime
  • services/cloud-agent-next/src/agent-sandbox/vercel/vercel-agent-sandbox.test.ts - no issues; manifest and raw verification fixture both use 1.3.14
  • services/cloud-agent-next/src/sandbox-image-versions.test.ts - no issues; Pinned RUNTIME_DISTRIBUTION.bun assertion and the wrapper @types/bun parity assertion now agree on 1.3.14
  • services/cloud-agent-next/src/shared/runtime-distribution.ts - no issues; single source of truth back to 1.3.14
  • services/cloud-agent-next/wrapper/package.json - no issues; @types/bun back to 1.3.14, keeping the wrapper typecheck aligned with the runtime

Notes: no runtime code paths changed in this commit, so no new memory-leak surface was introduced, and the net PR diff against main no longer alters the Bun version at all. The previously reported @types/bun drift is resolved by the runtime revert rather than the earlier types bump; the author's inline reply still describes the superseded 1.4.3 direction, and the inline thread itself is outdated. This review only covered the commit a3b25fbf..f7ca0a57; Docker image builds and cold/warm smoke tests were not re-run here, and the PR body already states they were not re-run for the 1.3.14 combination.

Previous review (commit a3b25fb)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit resolves the prior @types/bun drift, and the accompanying test adjustments are internally consistent (order-sensitive policy expectation matches pnpm-workspace.yaml, KILO_CLI_VERSION import resolves, and the new wrapper parity assertion matches RUNTIME_DISTRIBUTION.bun). No new runtime code was introduced, so no memory-leak surface was added.

Files Reviewed (6 files)
  • apps/mobile/src/components/agents/chat-composer-slash-commands.test.ts - no issues; the expectation now tracks the English source string instead of a duplicated literal
  • apps/mobile/src/lib/minimum-release-age-policy.test.ts - no issues; added @cloudflare/sandbox@0.12.12 exactly matches the position in pnpm-workspace.yaml:59
  • services/cloud-agent-next/scripts/runtime-handoff.test.ts - no issues; KILO_CLI_VERSION is exported from src/shared/kilo-cli-version.ts
  • services/cloud-agent-next/src/sandbox-image-versions.test.ts - no issues; new assertion pins wrapper/package.json @types/bun to RUNTIME_DISTRIBUTION.bun (1.4.3)
  • services/cloud-agent-next/wrapper/package.json - no issues; @types/bun bumped to 1.4.3
  • pnpm-lock.yaml - no issues; @types/bun@1.4.3 / bun-types@1.4.3 snapshots and their @types/node@24.12.4 / undici-types@7.18.2 dependencies are present; the remaining @types/bun@1.3.14 entry belongs to services/gastown/container (floating oven/bun:1-slim), which this PR does not touch

Note: the previously reported @types/bun finding is fixed at HEAD and its inline thread carries the author's confirmation, so it is not repeated here.

Previous review (commit 9239c79)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

No new defects in the incremental commit that authenticates SDK setup, accepts the isolated /workspace/app layout for exclusive ownership, and polls KILO_SESSION_SNAPSHOT_PENDING; the only unresolved item remains the wrapper @types/bun pin drifting from the Bun 1.4.3 container runtime.

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 1
Issue Details (click to expand)

SUGGESTION

File Line Issue
services/cloud-agent-next/wrapper/package.json 16 @types/bun is still pinned at 1.3.14 while the container runtime (and wrapper build/execution) is 1.4.3, so wrapper typechecking validates against older Bun typings.
Files Reviewed (3 files)
  • services/cloud-agent-next/test/e2e/sandbox-control.ts - no new issues; the /workspace/app isolated-layout acceptance still requires the directory count and listener allowlist checks
  • services/cloud-agent-next/test/e2e/sdk-basic-chat.ts - no new issues; cleanup now re-discovers the current owned sandbox and uses the control-plane stop proof with a 30s family-gone bound
  • services/cloud-agent-next/test/unit/e2e/sandbox-control-cleanup.test.ts - no new issues; new cases cover the isolated layout and its sibling/listener rejections

Note: the carried-forward @types/bun suggestion was re-verified against current HEAD (wrapper/package.json line 16 is still 1.3.14; Dockerfile still pins BUN_VERSION="1.4.3"). The full Docker build was not run here.

Previous review (commit bd39468)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

No new defects in the incremental commit that pins the inherited Node/GitHub CLI runtimes; the only unresolved item remains the wrapper @types/bun pin drifting from the Bun 1.4.3 container runtime.

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 1
Issue Details (click to expand)

SUGGESTION

File Line Issue
services/cloud-agent-next/wrapper/package.json 16 @types/bun is still pinned at 1.3.14 while the container runtime (and wrapper build/execution) is 1.4.3, so wrapper typechecking validates against older Bun typings.
Files Reviewed (3 files)
  • services/cloud-agent-next/Dockerfile - 1 carried-forward issue (existing inline comment)
  • services/cloud-agent-next/Dockerfile.dev
  • services/cloud-agent-next/src/sandbox-image-versions.test.ts

The node-runtime stage replaces the inherited Node without disturbing the base image entrypoint; GH_VERSION pins and the pinned-gh tarball install now match Dockerfile.containers/Dockerfile.dind, and the parity tests were correctly widened to cover Dockerfile, Dockerfile.dev, and the runtime-free recipe. Docker builds were not run here, so the production image and the multi-arch assumption behind the hardcoded linux_amd64 gh asset remain unverified (the same existing pattern is used in the other images).

Fix these issues in Kilo Cloud

Previous review (commit 32657aa)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 0
SUGGESTION 1
Issue Details (click to expand)

SUGGESTION

File Line Issue
services/cloud-agent-next/Dockerfile 7 Container Bun runtime is bumped to 1.4.3, but wrapper/package.json still pins @types/bun at 1.3.14, so wrapper typechecking drifts from the runtime.

Version pins were checked for consistency across all five Dockerfiles, runtime-distribution.ts, kilo-cli-version.ts, wrangler.jsonc (16 KILOCODE_CLI_VERSION image vars), the wrapper/Worker SDK pins, and the slash-command source. The lockfile, workspace exception, and test updates are internally consistent; no stale pins remain outside historical test fixtures and docs. Docker builds and container smoke tests were not run in this environment, so image-level behavior (including the new npm-installed Bun in the Sandbox-based images) is unverified.

Files Reviewed (18 files)
  • apps/mobile/src/i18n/locales/en.json
  • pnpm-lock.yaml
  • pnpm-workspace.yaml
  • services/cloud-agent-next/Dockerfile - 1 issue
  • services/cloud-agent-next/Dockerfile.containers
  • services/cloud-agent-next/Dockerfile.containers.runtime-free
  • services/cloud-agent-next/Dockerfile.dev
  • services/cloud-agent-next/Dockerfile.dind
  • services/cloud-agent-next/package.json
  • services/cloud-agent-next/scripts/runtime-manifest.test.ts
  • services/cloud-agent-next/scripts/vercel-snapshot.test.ts
  • services/cloud-agent-next/src/agent-sandbox/vercel/vercel-agent-sandbox.test.ts
  • services/cloud-agent-next/src/sandbox-image-versions.test.ts
  • services/cloud-agent-next/src/shared/default-slash-commands.generated.ts
  • services/cloud-agent-next/src/shared/kilo-cli-version.ts
  • services/cloud-agent-next/src/shared/runtime-distribution.ts
  • services/cloud-agent-next/wrangler.jsonc
  • services/cloud-agent-next/wrapper/package.json

Fix these issues in Kilo Cloud

Reviewed by deepseek-v4.1-flash-1017 · Input: 43.8K · Output: 6.8K · Cached: 377.6K

Review guidance: REVIEW.md from base branch main

@eshurakov Kilo Code Bot

eshurakov commented Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

Follow-up in 9239c79:

  • SDK test setup now reads INTERNAL_API_SECRET from the existing local .dev.vars configuration and supplies it only through the internal tRPC test driver. The public Kilo SDK client remains bearer-only; no production balance guard was relaxed.
  • Updated stale container discovery/cleanup in the SDK harness for control-plane sessions and isolated /workspace/app containers. Added cleanup regression tests for unknown siblings and foreign listeners, and a bounded 30-second retry for KILO_SESSION_SNAPSHOT_PENDING.
  • 607 tests passed across all test/unit/e2e suites and middleware balance tests. Cloud Agent typecheck, targeted lint, formatting, and diff checks passed.
  • Fresh cold/warm chat smoke passed in 10.1 seconds, including the exact initial reply internal-auth-smoke and three completed warm turns on the same container.
  • The SDK acceptance script now passes admission, warm session/transcript reads, physical container stop, cold session/transcript reads and pagination. It still fails later waiting for cloud.message.queued on the scoped SDK SSE stream. Source investigation found publishCloudAgentExtensionEvent is called by legacy CloudAgentSession, but not the control-plane path. This is a separate event-delivery gap, not an authentication error; the assertion is retained and full SDK acceptance is not marked passing.
  • Exact owned failed-test runtimes were reclaimed with ownership checks. No deployment or real-model calls performed.

@socket-security

socket-security Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

eshurakov added a commit that referenced this pull request Oct 20, 2026
@eshurakov
build(cloud-agent): upgrade container dependencies (#8298)
af6dedd
@eshurakov
eshurakov force-pushed the kilo/smooth-beacon-p1p branch from f7ca0a5 to af6dedd Compare October 20, 2026 20:42
@eshurakov
eshurakov force-pushed the kilo/smooth-beacon-p1p branch from af6dedd to 20df7ca Compare October 20, 2026 20:54
@eshurakov
eshurakov added this pull request to the merge queue Oct 21, 2026
Merged via the queue into main with commit 40cb44c Oct 21, 2026
113 checks passed
@eshurakov
eshurakov deleted the kilo/smooth-beacon-p1p branch October 21, 2026 10:04
@eshurakov eshurakov mentioned this pull request Oct 21, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kilo-code-bot kilo-code-bot[bot] kilo-code-bot[bot] left review comments
@chrarnoldus chrarnoldus chrarnoldus approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eshurakov @chrarnoldus