feat(github): share installations with web Cloud Agents (2/4) by pandemicsyn · Pull Request #5978 · Kilo-Org/cloud

pandemicsyn · 2026-09-08T17:59:17Z

Outcome

Default-off shared canonical GitHub installations for WEB Cloud Agents with exact tenant-association pinning. Slack shared use remains PR3; Code Reviewer shared routing remains PR4.

Reviewed base: current main at cf59d8662499749228164232615da5af0abe5134. Reviewed head: af1734d3ce0b8d11acad16622754be8618603cdb.

Exact Association Boundaries

Generic token and Chat SDK webhook paths require canonical sharing_mode = exclusive. Managed shared lookup requires an exact active association ID. GitHub bot-link signed state carries exact platformIntegrationId; callback validates association, installation, Standard/Lite identity, canonical lifecycle, local health, and current Kilo owner or organization membership.

Predeploy bot-link state without an association ID is accepted only while management and sharing admission remain disabled and only for one healthy canonical-exclusive or true-legacy literal-null app association. Explicit Standard rows require exact signed association identity. Keep features disabled for at least one signed-state TTL after deployment.

Simple Synchronous Lifecycle

Required canonical/local database cleanup runs first and fails non-2xx without recording completion. Standard bot unlink runs second as best-effort alerting. Completed-success receipts dedupe later deliveries; concurrent and crash-window repeats are idempotent. GitHub does not automatically retry failed webhooks, so manual redelivery after database failure is the accepted recovery. No lifecycle queue, cron, outbox, lease, fencing, Retry-After, or automatic retry worker exists.

Repository refresh follows lifecycle lock order and cannot revive terminal state.

Provider Reservation Boundary

Slack, Linear, and Discord OAuth attempts are durable, expiring, owner-row locked, purpose-bound, and single-use. PR3 owns provider-installation generation and lazy recovery.

Migration And Rollout

Generated migration: 0243_exotic_triton.sql. Replacement indexes build concurrently with required transaction boundaries. Before enabling sharing, stale eligible-unlinked must be zero. PR2 adds no canonical reconciliation DML.

Verification

Accepted pre-rebase bot-link/state/DB resolver suite: 99 passed
Accepted pre-rebase schema/migration suite: 101 passed; fresh bootstrap passed
Final-rebase Git token service: 633 passed
Final-rebase focused Cloud Agent suites: 429 passed
Final-rebase range-diff: all 28 PR2 commits exact
Changes-only typecheck and web/DB/token/Cloud Agent lint: passed
Format, whitespace, and conflict-marker checks: passed

The final-rebase PostgreSQL-backed Jest/bootstrap rerun was blocked before test execution because the local OrbStack Docker daemon was unresponsive; docker info, Compose health, and pnpm test:db timed out. This was not an assertion failure. The accepted pre-rebase head had the schema/bootstrap and focused web suites passing.

No production queries, repairs, associations, settings, flags, backfills, deployments, or external provider operations were performed.

kilo-code-bot · 2026-09-09T18:00:05Z

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

findGitHubBotLinkIntegrations applies .limit(2) before its JS candidate filter, so the bot-link "exactly one healthy association" ambiguity guard can fail open when three or more associations share an installation.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`apps/web/src/lib/integrations/db/platform-integrations.ts`	96	`.limit(2)` runs before the JS usability filter, so with three or more matching associations the arbitrary pair (no `ORDER BY`) can contain exactly one usable row and `usableCandidates.length === 1` accepts an ambiguous bot link instead of failing closed. Move the candidate filters into SQL or drop the limit and count in JS.

Files Reviewed (5 files)

apps/web/src/lib/integrations/db/platform-integrations.ts - 1 issue
apps/web/src/lib/bot/github-link-state.ts
apps/web/src/app/api/integrations/github/callback/route.ts
apps/web/src/app/github/link/route.ts
apps/web/src/lib/integrations/github/multiple-installations.ts

Fix this issue in Kilo Cloud

Inline publication was blocked: this PR has an existing bot pending review (id 5158007287) that this session is not permitted to clear, so the finding is recorded here.

Previous Review Summaries (10 snapshots, latest commit fda919a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `fda919a`)