Repository navigation
fix(cloud-agent-next): deliver full profiles to control-plane sessions - #7238
Merged
eshurakov merged 1 commit intoOct 7, 2026
Merged
Conversation
eshurakov
force-pushed
the
eshurakov/deliver-profile-secrets
branch
2 times, most recently
from
October 7, 2026 08:23
dea671f to
b96f997
Compare
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryFull re-review of the 30-file change (delivering complete profiles to control-plane sessions, materializing profile secrets into the prepare frame, forcing per-session runtime isolation, and the shared runtime-profile/schema refactor) found no new issues; every previously raised finding is addressed in the current head. Files Reviewed (30 files)
Previous Review Summaries (5 snapshots, latest commit cc6cbc8)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit cc6cbc8)Status: No Issues Found | Recommendation: Merge Executive SummaryThe incremental commit adds the 1–200 character path bound to the shared Files Reviewed (2 files)
Previous review (commit b53ba18)Status: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe incremental commit fixes the prior critical (runtime profile collections now survive Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (9 files)
Fix these issues in Kilo Cloud Previous review (commit 850e220)Status: 1 Critical, 4 Suggestions | Recommendation: Address before merge Executive SummaryThe new control-plane profile delivery is wired end to end at registration but never reaches the wrapper: the Sandbox DO's Overview
Issue Details (click to expand)CRITICAL
SUGGESTION
Files Reviewed (19 files)
Targeted carry-forward checks on unchanged files: Fix these issues in Kilo Cloud Previous review (commit 111c699)Status: 3 Issues Found | Recommendation: Address before merge Executive SummaryProfile secrets now reach Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (15 files)
Fix these issues in Kilo Cloud Previous reviewStatus: 3 Issues Found | Recommendation: Address before merge Executive SummaryProfile secrets now reach workspace control-plane frames, but a sibling session sharing a worktree directory can reuse one Kilo runtime and thereby apply one session's decrypted secrets while dropping its own. Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (14 files)
Reviewed by deepseek-v4.1-flash · Input: 160.1K · Output: 49.5K · Cached: 4.8M Review guidance: REVIEW.md from base branch |
eshurakov
force-pushed
the
eshurakov/deliver-profile-secrets
branch
from
October 7, 2026 09:57
8ef2261 to
111c699
Compare
eshurakov
changed the title
- Deliver profile secrets to control-plane sessions. - Deliver complete profiles to the control plane. - Isolate secret-bearing runtimes and gate frame failures. - Address profile delivery review gaps. - Skip overlong legacy skill paths.
eshurakov
force-pushed
the
eshurakov/deliver-profile-secrets
branch
from
October 7, 2026 19:27
cc6cbc8 to
fbcf656
Compare
pandemicsyn
approved these changes
Oct 7, 2026
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Profiles were resolved into metadata, but
workspace_*control-plane sessions received neither encrypted environment variables nor skills, custom agents, or Kilo commands. This change delivers all profile collections through control-plane preparation.KILO_CONFIGfile, allowing large valid prompts/templates without exceeding process environment limits. Credential refresh preserves the config path; preparation clears stale profile artifacts from restored homes.Verification
No additional manual full-stack run was performed for the skills/agents/commands addition. Earlier validation of this branch on a local stack verified that a secret supplied through the follow-up environment change reached a
workspace_*sandbox, appeared as[REDACTED]in setup output, and was absent from Worker logs and Durable Object state. A profile-secret launch itself was not separately exercised; the snapshot skip remains covered by tests.Visual Changes
N/A
Reviewer Notes
Stacked on #7237; review the three commits above that base. The newest commit completes skill/agent/command delivery and isolates plain-env profiles.
Current checks passed: focused Worker registration/preflight/session-service/sandbox suites, wrapper preparation/materialization/legacy-bootstrap tests, service and wrapper typecheck, service lint, wrapper build, formatting, and the duplication ratchet (no new duplication). A pinned Kilo 7.8.1 discovery test confirmed that the actual CLI exposes the delivered skill, skill slash command, custom agent, and Kilo command, and that the companion file is present. Artifact tests cover credential-refresh preservation, sibling isolation, stale artifact removal, safe companion paths, and 100KB command templates using disk-backed config.
The earlier commits also passed the sandbox-control Workers integration suites and the full cloud-agent-next unit suite; those broad checks were not repeated for the newest commit.
Rollout requires the rebuilt wrapper. Existing allocations with an older wrapper cannot consume the new profile fields; secret-bearing launches on wrappers lacking named-secret redaction continue to fail closed until the allocation stops. No production deployment was performed.