[eshurakov]

Summary

• Add e2e:local-kilo: test driver -> isolated local kilo serve -> local Cloud Agent stack -> real sandbox/runtime.
• Discover worktree service ports, validate database ownership, and use a dedicated HOME/XDG configuration with local-only origins and in-memory credentials.
• Exercise workspace listing/creation and creation replay, workspace detail, a second session, preparation/sandbox SSE, native snapshot/fence/live events, and two follow-up turns with durable transcript checks.
• Preserve nullable account peppers exactly, bound transcript-read readiness waits, and clean up only owned workspace/profile/attachment/process resources.

Verification

No human/manual UI testing was performed. An agent launched the manual local-stack driver and verified all six live paths through local Kilo. The run used Bun 1.4.4 and the companion Kilo client changes. It did not change normal CLI authentication.

Automated Checks

• All six end-to-end scenarios passed in one run: local-kilo-1793115227636-2168fef8.
• Four launcher/transport tests passed, including environment isolation, incremental SSE decoding, bounded frames, live HTTP delivery, and cancellation.
• Targeted lint and git diff --check passed.
• Post-run database inspection confirmed zero remaining owned profile records and zero owned session rows.
• Model responses used kilo/fake-deterministic. Worker, Durable Objects, PostgreSQL, Docker sandbox, wrapper, and Kilo processes were real. This does not claim browser or real-model coverage.

Visual Changes

N/A

Reviewer Notes

• Stacked on feat(cloud-agent): expose hosted system event feed #8972. This PR contains only the local-Kilo integration runner, fixture correction, launcher tests, package command, and documentation.
• Matching Kilo hosted workspace, token-exchange, and system-feed client: feat(cli): add hosted workspaces and cloud system feeds kilocode#15509. Check out that branch in the external source checkout.
• Merge this test PR after both implementations. Its current base is the Cloud implementation branch, keeping the review diff limited to integration coverage.
• All acceptance operations go through local Kilo. Direct stack access is limited to fixture setup, health, fake-model gates, and cleanup.
• Start the local cloud-agent group, install the Kilo checkout's locked dependencies, and select its pinned Bun version. The README documents the three required arguments: --kilo-repo, --bun, and --email.
• Reports and redacted traces remain in ignored dev/logs; credentials and evidence files are not committed.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

No new pull-request code changed since the previous review at 6cea912: the incremental range contains only base-branch content, and the previously flagged empty-pepper warning is correctly resolved by preserving '' and exercising the real bearer verifier.

Assumptions: [INFERENCE] The incremental range 6cea912..4601bf8e touches only services/cloud-agent-next/src/kilo-facade/system-feed.test.ts, which is a commit on the stacked base branch (e5e5a2a750) rather than this PR's diff, so it was not reviewed as this PR's change. Live local-stack execution and the external Kilo checkout passed via --kilo-repo remain unverified here; the PR reports passing runs.

Files Reviewed (8 files)

• services/cloud-agent-next/package.json - no issues
• services/cloud-agent-next/test/e2e/README.md - no issues
• services/cloud-agent-next/test/e2e/auth.ts - no issues
• services/cloud-agent-next/test/e2e/client.ts - no issues
• services/cloud-agent-next/test/e2e/local-kilo-acceptance.ts - no issues
• services/cloud-agent-next/test/e2e/local-kilo.ts - no issues
• services/cloud-agent-next/test/unit/e2e-auth.test.ts - no issues
• services/cloud-agent-next/test/unit/local-kilo.test.ts - no issues

Previous Review Summaries (2 snapshots, latest commit 6cea912)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 6cea912)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commits type the isolated Kilo environment and replace the stale empty-pepper assertion with a test that exercises the real bearer verifier, resolving the prior warning; no new issues found in the incremental diff.

Assumptions: [INFERENCE] The external Kilo checkout passed via --kilo-repo and the stacked base are not available in this repository, so live integration behavior and the external session-host response shapes were not re-verified here.

Files Reviewed (3 files)

• services/cloud-agent-next/test/e2e/local-kilo-acceptance.ts - no issues
• services/cloud-agent-next/test/e2e/local-kilo.ts - no issues
• services/cloud-agent-next/test/unit/e2e-auth.test.ts - no issues

Previous review (commit 463f34e)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The local-Kilo acceptance runner is well isolated and resource-bounded, but the || → ?? pepper change breaks an existing unit test that CI runs.

Assumptions: [INFERENCE] The external Kilo checkout passed via --kilo-repo is not in this repository, so /kilocode/session-host response shapes, the item.profileID reconciliation match, and SSE event names could not be verified here; the PR reports a passing live run. The stacked base (eshurakov/cloud-agent-system-feed) was reviewed as given.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/test/e2e/auth.ts	205	?? preserves an empty-string pepper, so the existing e2e-auth.test.ts "normalizes an empty persisted pepper to null" assertion fails deterministically under pnpm --filter cloud-agent-next test

Files Reviewed (7 files)

• services/cloud-agent-next/package.json - no issues
• services/cloud-agent-next/test/e2e/README.md - no issues
• services/cloud-agent-next/test/e2e/auth.ts - 1 issue
• services/cloud-agent-next/test/e2e/client.ts - no issues
• services/cloud-agent-next/test/e2e/local-kilo-acceptance.ts - no issues
• services/cloud-agent-next/test/e2e/local-kilo.ts - no issues
• services/cloud-agent-next/test/unit/local-kilo.test.ts - no issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-flash-latest · Input: 31.4K · Output: 4.7K · Cached: 288K}

_{Review guidance: REVIEW.md from base branch eshurakov/cloud-agent-system-feed}

[eshurakov]

Maintenance verification for head 6cea912665029a1dd2591a156cb54b52296e13d6, still stacked on eshurakov/cloud-agent-system-feed (33252ff366).

Pushed 2d03b6133e (real-verifier regression coverage for nullable, empty and non-empty persisted peppers) and 6cea912665 (type-only fixes for the isolated child environment and cleanup callback). The reported CI failure was reproduced first. Its review thread is replied to and resolved with the exact authentication-contract evidence; the refreshed bot review reports no issues.

Final observed CI: 37 successful checks, 14 intentionally skipped, zero failed or pending. All four Cloud Agent suites are green. Local checks passed: 219 unit files / 5,855 tests, all 10 focused auth/helper tests, service and wrapper typechecks, an additional runner-inclusive typecheck, scoped lint, formatting and git diff --check.

A fresh six-scenario acceptance run also passed in this sandbox, using read-only companion source eshurakov/cloud-agent-hosted-workspaces at d5637816db2af38a4cd954fe42e41b1477f22a69 and pinned Bun 1.4.4:

1. List cloud workspaces.
2. Create a workspace, discover its root and reconcile the same operation key.
3. Replay preparation and observe an active sandbox on the system feed.
4. Join native snapshot and live assistant events.
5. Start another session in the existing workspace.
6. Send follow-ups with stable identity, live events and durable history.

These operations went through the separate isolated Kilo process, with real local Worker, DOs, PostgreSQL, Docker sandbox and wrapper. Only model responses were deterministic fake responses. The reused owned local fixture had a NULL database pepper. The run report recorded all six passes and successful workspace deletion; independent SQL reads then confirmed zero owned profile/session rows and a completed worktree deletion with no runtime locations. The created local stack and its exact leftover proxy were stopped and removed.

No parent or companion branch was modified or pushed, and no deployment or production mutation was performed. No remaining blocker for this PR was observed. This does not claim real-model or browser-UI coverage. Private ignored run evidence is retained under dev/logs/local-kilo-1793120809037-5b8aa040/ in this ephemeral sandbox.