[eshurakov]

Summary

New KiloBot Cloud Agent sessions failed registration because the bot sent its legacy model-provider token. Issue a separate, one-hour workflow control token when the bot spawns a session. Use the current workflow user and preserve the integration's organization scope and chat platform.

Model-provider authentication and the runtime authorization guard remain unchanged.

Verification

No manual or production session was started. Automated regression tests exercise the bot runner, the real session-spawn tool, and the real runtime authorization issuer with controlled principal and membership adapters.

Visual Changes

N/A

Reviewer Notes

• The regression failed before the fix and passes with it.
• Coverage includes personal and organization sessions, control-token lifetime and claims, current workflow credentials, unchanged model authentication, and rejection without organization membership.
• Existing workflow issuance settings apply: SHARED_RESOURCE_TOKENS_ENABLED=true and CLOUD_AGENT_RESOURCE_TOKENS_ENABLED=true.
• Local verification: 18 focused tests passed; web typecheck, scoped lint, formatting, and diff validation.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the two-file change that swaps the bot's legacy model-provider token for a one-hour cloud-agent-next workflow control token when spawning sessions; the token is scoped to the integration's organization and chat platform, and the control/authorization flow matches the established code-review issuance pattern.

Assumptions: [INFERENCE] The cloud-agent-next worker (external to this repo, addressed via CLOUD_AGENT_NEXT_API_URL) accepts the new aud: cloud-agent-next control token and derives runtime admission from its runtimeAdmission claims; the added tests mock the client, so worker-side acceptance is not exercised here. Org-scoped bot sessions now require the acting user to be an organization member by design, which is covered by the new rejection test.

Files Reviewed (2 files)

• apps/web/src/lib/bot/agent-runner.ts - no issues
• apps/web/src/lib/bot/agent-runner.test.ts - no issues

---

_{Reviewed by deepseek-flash-latest · Input: 83.2K · Output: 18.2K · Cached: 1.6M}

_{Review guidance: REVIEW.md from base branch main}