[eshurakov]

Summary

• Let a spawning Cloud Agent choose the child completion callback destination: the parent chat (session:parent) or a new chat in the parent workspace (workspace:new-chat).
• A workspace callback creates a sibling chat in the parent workspace, with the child result as its first message. The new chat inherits the workspace repository, sandbox and agent.
• Callback and initial-turn identities are derived from the persisted callback message ID, so queue retries stay idempotent.
• Callback payloads include callbackSessionId so the receiving agent knows its own session.
• The parent Session DO mints a sibling runtime authorization; the callback consumer never receives a user credential.

Verification

• pnpm --filter cloud-agent-next typecheck
• pnpm --filter cloud-agent-next test (6726 tests)
• pnpm --filter kilo-mcp test (673 tests)
• pnpm --filter @kilocode/worker-utils test (1193 tests)
• Web typecheck and MCP catalog/markdown generator check
• pnpm --filter cloud-agent-next check:duplication
• Web Jest suite was not run because its Postgres test database is unavailable in this sandbox.

[kilo-code-bot]

SUGGESTION: Terminal authorization denials are classified as transient and retried five times.

authorizeCloudAgentWorkspaceSibling (line 87) and assertCloudAgentParentAuthority throw plain Error values — e.g. Cloud Agent parent authority denied for a revoked/disabled parent or a non-anchor parent — and the destination-mismatch TRPCError CONFLICT on line 104 is likewise unrecoverable. Because permanent only recognizes the five TRPCError codes above, all of these report status: 503 and go through the full 5-attempt backoff before the callback is dropped, unlike the session:parent path which fails these fast through resolveParentCallbackSession's FORBIDDEN. Consider classifying the known denial errors (or throwing a TRPCError/shared denial code from the authority helper) so a revoked parent fails once.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

No blocking defect was found in the new child-callback workspace-chat path; the only finding is that terminal authorization denials are classified as transient and retried instead of failing fast.

Assumptions: [INFERENCE] Callback-created chats resolve their spawn authority through the canonical workspace anchor, so they can launch further children; no explicit recursion/fan-out bound was verified and cost is assumed to be bounded by the existing billing/admission gates (not fully traced). The Web Jest suite was not run per the PR description.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/callbacks/parent-workspace.ts	108	Permanent authorization denials (plain Error from authorizeCloudAgentWorkspaceSibling) are treated as transient and retried through the full 5-attempt backoff instead of failing once.

Files Reviewed (26 files)

• .kilo/skills/kilo-mcp/SKILL.md - 0 issues
• .specs/cloud-agent-session.md - 0 issues
• apps/web/src/lib/auth/cloud-agent-authority.test.ts - 0 issues
• apps/web/src/routers/cloud-agent-next-schemas.ts - 0 issues
• apps/web/src/scripts/mcp-catalog/skill-template.md - 0 issues
• packages/worker-utils/src/cloud-agent-authority.test.ts - 0 issues
• packages/worker-utils/src/cloud-agent-authority.ts - 0 issues
• services/cloud-agent-next/README.md - 0 issues
• services/cloud-agent-next/docs/control-plane.md - 0 issues
• services/cloud-agent-next/src/callbacks/parent-session.test.ts - 0 issues
• services/cloud-agent-next/src/callbacks/parent-session.ts - 0 issues
• services/cloud-agent-next/src/callbacks/parent-workspace.test.ts - 0 issues
• services/cloud-agent-next/src/callbacks/parent-workspace.ts - 1 issue
• services/cloud-agent-next/src/callbacks/queue-consumer.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-authority.test.ts - 0 issues
• services/cloud-agent-next/src/cloud-agent-authority.ts - 0 issues
• services/cloud-agent-next/src/control-plane/session/callbacks.test.ts - 0 issues
• services/cloud-agent-next/src/control-plane/session/callbacks.ts - 0 issues
• services/cloud-agent-next/src/control-plane/session/session-do.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-prepare.test.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-prepare.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-worktree.test.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-worktree.ts - 0 issues
• services/kilo-mcp/catalog.json - 0 issues (generated)
• services/kilo-mcp/src/child-session-tools.test.ts - 0 issues
• services/kilo-mcp/src/child-session-tools.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-flash-latest · Input: 118.5K · Output: 50.4K · Cached: 4.4M}

_{Review guidance: REVIEW.md from base branch main}