[eshurakov]

Summary

• Enable the existing workspace-scoped Cloud Agent MCP design by removing the leftover per-chat isolation guard. Workspace configuration, canonical-parent authority and callbacks already existed in fix(cloud-agent): configure Kilo once per workspace #9010 / feat(cloud-agent): notify parent sessions when child tasks finish #8306.
• Retain built-in MCP credentials per runtime across sibling attachment, older/missing grants, model-token refreshes and concurrent preparation.
• Add scoped direct-child lifecycle controls: listChildSessions, getSession, getMessageResult, interruptSession and prompt-only sendMessage, alongside existing prepareSession. Personal and organization paths are pinned to the signed authority.
• Recheck current canonical-parent authorization, owner, exact organization and persisted direct-child lineage before management. Parents, sibling chats and unrelated sessions remain inaccessible. Spawned children cannot recursively spawn.
• Add a durable parent-DO child index with bounded cursor pagination. Entries are discovery hints and are reauthorized; access outages fail instead of pretending no children exist.
• Preserve terminal assistant output, safe failures and timestamps for message-result inspection. Paid follow-ups perform balance checks with the server-side parent runtime credential; expired child delegation is not silently renewed.
• Fix trusted GitHub integration metadata rejection during child creation, and update workspace ownership/spec guidance and MCP instructions/catalog.

Verification

• Original runtime regression reproduced before the guard fix; 239 wrapper/runtime tests passed.
• Lifecycle Worker unit suites: 519 tests passed.
• Shared scoped authority contract: 82 tests passed.
• Full Kilo MCP suite: 598 tests passed.
• Focused mocked web client, scoped middleware and child-lifecycle router suites: 136 tests passed.
• Real Workers child registry, management and migration suites: 27 tests passed.
• Worker/wrapper, worker-utils, web-shared and MCP typechecks passed; focused web typecheck includes changed routers/client and affected UI consumers.
• Changed-file formatting/lint, catalog regeneration/drift check and git diff --check passed.
• Independent review findings addressed, including paid follow-up authorization, outage reporting, permanent parent denial, org deploy compatibility and credential-refresh races.
• Full DB-backed web router suites remain unverified: PostgreSQL and Docker are unavailable here. No live production child launch or deployment was performed.

Deployment And Limits

• Roll out Cloud Agent Worker (including lazy per-DO SQLite migration), updated web API, wrapper/runtime and Kilo MCP together; deploy the Worker before enabling the new web/MCP operations.
• Existing children created before the registry migration are not backfilled into listChildSessions; explicit inspect/result/send/interrupt by ID still validates their persisted lineage.
• interruptSession stops child work, not deletion of its workspace.
• Callbacks remain explicit via callbackTarget: { url: "session:parent" }, targeting the canonical workspace parent rather than the invoking sibling. Prefer callbacks; bounded status checks are supported without busy polling.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The incremental commit resolves all five prior findings (registry wipe/prune, best-effort hint writes with replay repair, the auth test, and both wrapper grant-lifecycle gaps); the only new item is a non-blocking hardening note that a failed best-effort child-registry prune cannot be repaired by a retried delete.

Assumptions: [INFERENCE] A stale registry entry only degrades discovery: cloud-agent-child-management.ts re-reads and re-authorizes every target, so a deleted child in the list yields a forbidden target rather than access. Not executed: the Worker, wrapper, and integration suites; findings are derived from reading code at 9eb6c85.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/control-plane/session/session-do.ts	2340	The best-effort prune runs after the wipe, and both delete entry points short-circuit once state is cleared, so a transient parent-DO failure leaves the deleted child permanently listed.

Files Reviewed (9 files)

• services/cloud-agent-next/src/control-plane/session/session-do.ts - 1 issue
• services/cloud-agent-next/src/control-plane/session/transactional-wipe.ts - 0 issues
• services/cloud-agent-next/src/middleware/auth.test.ts - 0 issues
• services/cloud-agent-next/src/middleware/balance.test.ts - 0 issues
• services/cloud-agent-next/src/session/session-prepare.test.ts - 0 issues
• services/cloud-agent-next/src/session/session-registration.ts - 0 issues
• services/cloud-agent-next/test/integration/control-plane-session-v2-child-registry.test.ts - 0 issues
• services/cloud-agent-next/wrapper/src/control-plane/prepare.test.ts - 0 issues
• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts - 0 issues

Fix these issues in Kilo Cloud

Previous Review Summaries (2 snapshots, latest commit ab60ee3)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit ab60ee3)

Status: 5 Issues Found | Recommendation: Address before merge

Executive Summary

The child-lifecycle commit adds direct-child management plus a per-parent child registry; the highest-risk gaps are that the registry is never cleared or pruned on session deletion, that the mandatory registry write can turn a completed create into a retry that never indexes the child, and that widening the scoped Worker allowlist leaves an existing test failing.

Assumptions: [INFERENCE] I did not execute the Worker suite; the middleware/auth.test.ts failure is derived by tracing that test's mocked successful validateKiloToken result through the new allowlist. [INFERENCE] Reachability of the transactional locator wipe for workspace parents is derived from acceptedHandleLocatorForWipe/tearDownSession, not a live reproduction.

Overview

Severity	Count
CRITICAL	0
WARNING	4
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/control-plane/session/sqlite-schema.ts	23	The new cloud_agent_child_sessions table is not deleted by resetSessionStorageWithLocator (only controlPlaneMessages and events are), so a parent that takes the locator wipe keeps child session, message and worktree IDs after deleteSession; the table is also never pruned when a child is deleted.
services/cloud-agent-next/src/session/session-registration.ts	2137	The parent-registry hint write is mandatory at all four call sites; on replay a parent-DO failure turns a completed idempotent create into an untyped INTERNAL_SERVER_ERROR, and on the ledger create paths the retry settles through reconcileLedgerCreate, which never records the child, leaving it permanently undiscoverable.
services/cloud-agent-next/src/middleware/auth.ts	19	Widening the scoped allowlist accepts getSession, but middleware/auth.test.ts still asserts a 403 for it, so that suite now fails.
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	1215	(Existing) A recovered workspace MCP grant is not installed into an already-warm runtime when the last sibling releases during this prepare, because the recovery install is gated on hasRoutesForKey rather than on the runtime being live/reused.

SUGGESTION

File	Line	Issue
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	1044	(Existing) workspaceMcpGrants is advanced before the grant is applied; a failed prepare while a sibling holds the key leaves the map ahead of the live runtime, and a later sibling prepare offering no/older grant skips the install.

Files Reviewed (48 files)

• .specs/cloud-agent-session.md - 0 issues
• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts - 0 issues
• apps/web/src/lib/cloud-agent-next/cloud-agent-client.test.ts - 0 issues
• apps/web/src/routers/cloud-agent-next-router.ts - 0 issues
• apps/web/src/routers/cloud-agent-next-router.test.ts - 0 issues
• apps/web/src/routers/cloud-agent-next-schemas.ts - 0 issues
• apps/web/src/routers/cloud-agent-next-child-lifecycle.test.ts - 0 issues
• apps/web/src/routers/organizations/organization-cloud-agent-next-router.ts - 0 issues
• apps/web/src/routers/organizations/organization-cloud-agent-next-router.test.ts - 0 issues
• packages/web-shared/src/lib/trpc/init.ts - 0 issues
• packages/web-shared/src/lib/trpc/init.test.ts - 0 issues
• packages/worker-utils/src/cloud-agent-authority.ts - 0 issues
• packages/worker-utils/src/cloud-agent-authority.test.ts - 0 issues
• services/cloud-agent-next/AGENTS.md - 0 issues
• services/cloud-agent-next/docs/control-plane.md - 0 issues
• services/cloud-agent-next/src/cloud-agent-authority.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-child-management.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-child-management.test.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-child-management.contract.test.ts - 0 issues
• services/cloud-agent-next/src/control-plane/session/drizzle/0002_aspiring_scourge.sql - 0 issues
• services/cloud-agent-next/src/control-plane/session/drizzle/meta/0002_snapshot.json - 0 issues
• services/cloud-agent-next/src/control-plane/session/drizzle/meta/_journal.json - 0 issues
• services/cloud-agent-next/src/control-plane/session/drizzle/migrations.js - 0 issues
• services/cloud-agent-next/src/control-plane/session/session-do.ts - 0 issues
• services/cloud-agent-next/src/control-plane/session/sqlite-schema.ts - 1 issue
• services/cloud-agent-next/src/middleware/auth.ts - 1 issue
• services/cloud-agent-next/src/middleware/balance.ts - 0 issues
• services/cloud-agent-next/src/middleware/balance.test.ts - 0 issues
• services/cloud-agent-next/src/router.ts - 0 issues
• services/cloud-agent-next/src/router/auth.ts - 0 issues
• services/cloud-agent-next/src/router/auth.test.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/list-child-sessions.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/list-child-sessions.test.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-execution.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-management.ts - 0 issues
• services/cloud-agent-next/src/router/schemas.ts - 0 issues
• services/cloud-agent-next/src/session/queue-message.ts - 0 issues
• services/cloud-agent-next/src/session/runtime-authorization-recovery-preflight.test.ts - 0 issues
• services/cloud-agent-next/src/session/session-prepare.test.ts - 0 issues
• services/cloud-agent-next/src/session/session-registration.ts - 1 issue
• services/cloud-agent-next/test/integration/control-plane-session-v2-child-registry.test.ts - 0 issues
• services/cloud-agent-next/test/integration/control-plane-session-v2-management.test.ts - 0 issues
• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts - 2 issues (carried forward, verified at HEAD)
• services/kilo-mcp/catalog.json - 0 issues
• services/kilo-mcp/src/call.ts - 0 issues
• services/kilo-mcp/src/index.ts - 0 issues
• services/kilo-mcp/src/search.ts - 0 issues
• services/kilo-mcp/src/cloud-agent-authority.test.ts - 0 issues

Verified on the incremental commit: the scoped authority allowlist, per-procedure schemas and org pinning fail closed; the Worker re-checks ctx.userId against the authority owner, the canonical parent's current authorization, and each target's persisted direct-child lineage/owner/org; org inputs are forwarded to the Worker only for delegated authority; cloudAgentManagedProcedure is equivalent to protectedProcedure without authority; the balance middleware mints the parent runtime credential only after the owner binding and pins the org; the preflight expiry guard is reachable only for the expired state; and search filters rows before generating per-procedure schemas.

Fix these issues in Kilo Cloud

Previous review (commit 8853f22)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	1215	A recovered workspace MCP grant is not installed into an already-warm runtime when the last sibling releases during this prepare, because the recovery install is gated on hasRoutesForKey rather than on the runtime being live/reused.

SUGGESTION

File	Line	Issue
services/cloud-agent-next/wrapper/src/control-plane/prepare.ts	1044	workspaceMcpGrants is advanced before the grant is applied; a failed prepare while a sibling holds the key leaves the map ahead of the live runtime, and a later sibling prepare offering no/older grant skips the install.

Files Reviewed (13 files)

• .specs/cloud-agent-session.md - 0 issues
• docs/security-architecture-overview.md - 0 issues
• services/cloud-agent-next/AGENTS.md - 0 issues
• services/cloud-agent-next/README.md - 0 issues
• services/cloud-agent-next/docs/control-plane.md - 0 issues
• services/cloud-agent-next/src/callbacks/parent-session.test.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-authority.test.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-authority.ts - 0 issues
• services/cloud-agent-next/src/router/auth.test.ts - 0 issues
• services/cloud-agent-next/wrapper/src/control-plane/prepare.test.ts - 0 issues
• services/cloud-agent-next/wrapper/src/control-plane/prepare.ts - 2 issues
• services/kilo-mcp/src/cloud-agent-authority.test.ts - 0 issues
• services/kilo-mcp/src/index.ts - 0 issues

Reviewed the workspace-scoped MCP grant lifecycle, the scoped preparation authority boundary, the child-session callback anchor path, and the updated documentation. The authorization change (githubIntegrationId accepted on the trusted internal boundary but absent from the public scoped schema) was traced through the web router and repository preflight and does not bypass owner/organization or repository authorization. No memory-leak found: the new workspaceMcpGrants entry is deleted when the last route for a runtime key releases, matching the existing workspaceConfigurations lifetime.

---

_{Reviewed by deepseek-flash-latest · Input: 103.8K · Output: 37K · Cached: 2.3M}

_{Review guidance: REVIEW.md from base branch main}