feat(github): share installations with web Cloud Agents (2/4) by pandemicsyn · Pull Request #5978 · Kilo-Org/cloud

pandemicsyn · 2026-09-08T17:59:17Z

Outcome

Default-off shared canonical GitHub installations for WEB Cloud Agents with exact tenant-association pinning. Slack shared use remains PR3; Code Reviewer shared routing remains PR4.

Authorization Boundaries

Generic repository, cached, integration-ID, and Chat SDK token paths require canonical sharing_mode = exclusive. Unbound legacy rows are usable only when no matching canonical identity exists. Managed shared lookup requires an exact active expectedIntegrationId; unpinned managed lookup requires exclusive mode.

Simple Synchronous Lifecycle

Installation lifecycle handling is intentionally synchronous and idempotent. For installation.deleted, required canonical/local database revocation runs first and propagates failure. Standard-app bot identity unlink runs second as best-effort alerting and cannot leave local GitHub authorization active or fail a completed database cleanup. Lite has no bot unlink flow.

Delivery dedupe records only completed success after required local lifecycle work succeeds. Completed duplicates return 200. A failed DB cleanup records no completed receipt and returns non-2xx with an alert; GitHub does not automatically retry, so manual redelivery is the accepted recovery. A crash before completion recording or concurrent duplicate may repeat idempotent cleanup. PR2 has no lifecycle queue, cron, outbox, pending lease, attempt fencing, poison state, hidden retry, or Retry-After.

Provider Reservation Boundary

Slack, Linear, and Discord OAuth attempts remain durable, expiring, owner-locked, purpose-bound, and single-use. PR3 owns provider-installation generation and lazy recovery.

Migration And Rollout

Generated migration: 0243_exotic_triton.sql. Replacement indexes build concurrently with required transaction boundaries. The accepted migration-to-app pending-install window is brief and monitored; retry the connection after promotion if an old callback fails. Before enabling sharing, stale eligible-unlinked must be zero. PR2 adds no canonical reconciliation DML.

Verification

Synchronous lifecycle and DB-backed token behavior suites: 75 passed
Full Git token service: 633 passed
Schema/migration: 101 passed; fresh bootstrap passed
Previously reviewed focused managed WEB Cloud Agent suites: 419 passed
Changes-only typecheck, web/DB/token lint, format/diff, and independent blocker review: passed

No production queries, repairs, associations, settings, flags, backfills, deployments, or external provider operations were performed.

This reverts commit ee85e37.

This reverts commit bbecb73.

This reverts commit 25817c7.

kilo-code-bot · 2026-09-09T18:00:05Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

In-lease GitHub lifecycle receipts now return retryable 503 with Retry-After; the five-file incremental change looks correct with high confidence.

Files Reviewed (5 files)

ENVIRONMENT.md
apps/web/src/lib/integrations/db/github-installations.test.ts
apps/web/src/lib/integrations/db/github-installations.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.ts

Previous Review Summaries (3 snapshots, latest commit f1bbbb4)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `f1bbbb4`)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Failed GitHub installation.deleted retries can still be acknowledged as duplicates while a pending receipt lease is held, so unlink/cleanup is never reclaimed.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
`apps/web/src/lib/integrations/platforms/github/webhook-handler.ts`	184	In-lease pending receipts return HTTP 200 Duplicate, so GitHub stops retrying after unlink+release failures

Files Reviewed (5 files)

apps/web/src/lib/integrations/db/github-installations.ts
apps/web/src/lib/integrations/github/git-token-service.behavior.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.ts - 1 issue
services/git-token-service/src/installation-lookup-service.ts

Previous review (commit `458e94b`)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Failed GitHub installation.deleted retries can still be acknowledged as duplicates while a pending receipt lease is held, so unlink/cleanup is never reclaimed.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
`apps/web/src/lib/integrations/platforms/github/webhook-handler.ts`	184	In-lease pending receipts return HTTP 200 Duplicate, so GitHub stops retrying after unlink+release failures

Files Reviewed (19 files)

ENVIRONMENT.md
apps/web/src/app/api/integrations/github/callback/route.ts
apps/web/src/app/api/integrations/linear/callback/route.test.ts
apps/web/src/lib/integrations/db/github-installations.test.ts
apps/web/src/lib/integrations/db/github-installations.ts
apps/web/src/lib/integrations/github/runtime-authorization.test.ts
apps/web/src/lib/integrations/github/runtime-authorization.ts
apps/web/src/lib/integrations/oauth-state.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.ts - 1 issue
apps/web/src/lib/integrations/provider-oauth-attempts.ts
apps/web/src/lib/organizations/organizations.ts
apps/web/src/lib/user/index.ts
packages/db/src/migrations/0243_gray_supernaut.sql
packages/db/src/migrations/meta/0243_snapshot.json
packages/db/src/migrations/meta/_journal.json
packages/db/src/schema.ts
services/git-token-service/src/installation-lookup-service.test.ts
services/git-token-service/src/installation-lookup-service.ts

Previous review (commit `d70becc`)

Status: 3 Issues Found | Recommendation: Address before merge

Executive Summary

Exclusive GitHub uninstall retries can skip cleanup after unlink failures, unpinned runtime auth stays broken after sharing demotion, and the migration rebuilds live platform_integrations unique indexes without CONCURRENTLY.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0243_eager_taskmaster.sql`	41	Blocking unique index rebuild on populated `platform_integrations` without `CONCURRENTLY`
`apps/web/src/lib/integrations/github/runtime-authorization.ts`	119	Unpinned runtime auth treats disconnected sibling rows as ambiguous after sharing demotion
`apps/web/src/lib/integrations/platforms/github/webhook-handlers/installation-handler.ts`	190	Rethrowing unlink failures skips exclusive uninstall cleanup on GitHub retry

Files Reviewed (50 files)

ENVIRONMENT.md
apps/web/src/app/api/integrations/bitbucket/connect/route.test.ts
apps/web/src/app/api/integrations/github/callback/route.ts
apps/web/src/app/api/integrations/linear/callback/route.test.ts
apps/web/src/app/api/integrations/linear/connect/route.test.ts
apps/web/src/components/cloud-agent-next/NewSessionPanel.tsx
apps/web/src/components/integrations/GitHubIntegrationDetails.tsx
apps/web/src/components/integrations/OrganizationGitHubInstallations.tsx
apps/web/src/components/shared/RepositoryCombobox.tsx
apps/web/src/lib/admin/github-installation-uninstall.test.ts
apps/web/src/lib/admin/github-installation-uninstall.ts
apps/web/src/lib/agent-config/db/agent-configs.ts
apps/web/src/lib/cloud-agent/github-integration-helpers.test.ts
apps/web/src/lib/cloud-agent/github-integration-helpers.ts
apps/web/src/lib/code-reviews/review-memory/settings.ts
apps/web/src/lib/integrations/db/github-installations.test.ts
apps/web/src/lib/integrations/db/github-installations.ts
apps/web/src/lib/integrations/db/platform-integrations.test.ts
apps/web/src/lib/integrations/db/platform-integrations.ts
apps/web/src/lib/integrations/github-apps-service.ts
apps/web/src/lib/integrations/github/multiple-installations.test.ts
apps/web/src/lib/integrations/github/multiple-installations.ts
apps/web/src/lib/integrations/github/runtime-authorization.test.ts
apps/web/src/lib/integrations/github/runtime-authorization.ts - 1 issue
apps/web/src/lib/integrations/github/sharing-compatibility.ts
apps/web/src/lib/integrations/oauth-state.test.ts
apps/web/src/lib/integrations/oauth-state.ts
apps/web/src/lib/integrations/oauth/common.ts
apps/web/src/lib/integrations/oauth/platforms/discord-callback.ts
apps/web/src/lib/integrations/oauth/platforms/linear-callback.ts
apps/web/src/lib/integrations/oauth/platforms/slack-callback.ts
apps/web/src/lib/integrations/platforms/github/adapter.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handler.ts
apps/web/src/lib/integrations/platforms/github/webhook-handlers/installation-handler.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handlers/installation-handler.ts - 1 issue
apps/web/src/lib/integrations/platforms/github/webhook-handlers/installation-target-handler.test.ts
apps/web/src/lib/integrations/platforms/github/webhook-handlers/installation-target-handler.ts
apps/web/src/lib/integrations/provider-oauth-attempts.test.ts
apps/web/src/lib/integrations/provider-oauth-attempts.ts
apps/web/src/lib/organizations/organizations.ts
apps/web/src/lib/security-agent/db/security-config.ts
apps/web/src/lib/user/index.test.ts
apps/web/src/lib/user/index.ts
apps/web/src/routers/github-apps-router.test.ts
apps/web/src/routers/github-apps-router.ts
packages/db/src/migrations/0243_eager_taskmaster.sql - 1 issue
packages/db/src/schema.test.ts
packages/db/src/schema.ts
services/git-token-service/src/installation-lookup-service.test.ts
services/git-token-service/src/installation-lookup-service.ts

_{Reviewed by grok-4.6 · Input: 77.4K · Output: 7.7K · Cached: 276.6K}

_{Review guidance: REVIEW.md from base branch main}

pandemicsyn · 2026-09-09T19:02:19Z

Addressed the review against the current head.

Blocking index rebuild: stale against the prior head. 0243_gray_supernaut.sql builds the four replacement canonical/pending indexes with CONCURRENTLY and the repository-required COMMIT/BEGIN migrator boundaries.
Runtime demotion ambiguity: valid and fixed in 727326424. Generic runtime authorization now filters active/local-health/canonical identity and sharing_mode = exclusive in SQL before LIMIT, so one active exclusive association remains usable when a disconnected sibling is retained; shared mode still fails closed.
Exclusive uninstall retry poison: valid and fixed in 727326424. installation.deleted now uses the attempt-fenced canonical pending/completed receipt for both exclusive and shared installations. Failed unlink/cleanup remains reclaimable, completed receipts suppress redelivery, and concurrent duplicates single-dispatch.

Verification: 69 focused runtime/lifecycle tests, 254 cleanliness behavior tests, 101 schema tests plus fresh bootstrap, 632 token tests, and 419 focused managed Cloud Agent tests passed.

pandemicsyn · 2026-09-09T19:51:29Z

Follow-up on the lifecycle retry disposition: cd4e7d7ba closes the remaining quick-redelivery gap. A pending receipt whose lease is still active now returns HTTP 503 with Retry-After rather than duplicate 200. Completed receipts alone return duplicate 200; expired pending leases reclaim. Attempt-version fencing protects newer claimants. Tests cover dispatch failure plus receipt-release failure, quick non-2xx retry, post-expiry reclaim/completion, concurrent winner, and completed duplicate.

The pending-index compatibility concern is an explicitly accepted rollout risk: no global bridge index is retained. The migration-to-app promotion window is brief and monitored, and old pending callbacks receive retry guidance after promotion.

pandemicsyn · 2026-09-10T14:07:39Z

Product simplification supersedes the prior receipt-lease disposition. Current head 622241ea3 now uses simple synchronous lifecycle handling:

Required canonical/local DB cleanup runs first and fails non-2xx without recording completion.
Standard bot unlink runs second as best-effort alerting and cannot undo or fail successful local cleanup.
Only completed-success receipts are stored; completed duplicates return 200.
No pending lease, attempt fencing, Retry-After, queue, cron, outbox, poison state, or automatic retry remains.
GitHub does not automatically retry failed webhooks; manual redelivery after a DB failure is the explicitly accepted recovery. Concurrent/crash-window repeats are tolerated because cleanup is idempotent.

Verification: 75 focused lifecycle and DB-backed token behavior tests, 101 schema tests plus fresh bootstrap, and all 633 token tests passed.

Base automatically changed from feat/github-connections-pr1 to main September 8, 2026 21:08

pandemicsyn force-pushed the feat/github-connections-pr2 branch from 43bceb3 to be5c58a Compare September 9, 2026 14:53

pandemicsyn added 17 commits September 9, 2026 10:55

feat(github): enable shared web agent installations

3f51428

fix(github): harden shared installation races

3cacba8

fix(github): serialize shared callback cleanup

292d492

fix(integrations): fence provider state mutations

ebf43f0

fix(integrations): serialize provider state sessions

27405d8

fix(integrations): restore provider session consistency

7ed5ce2

Revert "fix(integrations): restore provider session consistency"

dd1deb9

This reverts commit ee85e37.

Revert "fix(integrations): serialize provider state sessions"

df042dd

This reverts commit bbecb73.

Revert "fix(integrations): fence provider state mutations"

de9cfdf

This reverts commit 25817c7.

feat(integrations): reserve provider OAuth attempts

9965db8

fix(integrations): lock OAuth reservations by owner row

d4258ad

fix(integrations): fence provider OAuth state purpose

5dbcea5

test(integrations): harden OAuth reservation races

a787dc0

test(integrations): prove OAuth owner-row blocking

aa28046

fix(github): serialize verified owner cardinality

d141d72

test(integrations): include OAuth state issue time

4f1188b

chore(db): regenerate shared GitHub migration

d70becc

pandemicsyn force-pushed the feat/github-connections-pr2 branch from fa6817f to d70becc Compare September 9, 2026 16:36

pandemicsyn marked this pull request as ready for review September 9, 2026 17:39

pandemicsyn added 2 commits September 9, 2026 13:46

fix(github): close shared runtime isolation gaps

de7d9ff

fix(github): fence exclusive lifecycle retries

7273264

pandemicsyn added 3 commits September 9, 2026 14:15

fix(github): close legacy authorization edges

458e94b

fix(github): fence direct token legacy paths

f1bbbb4

fix(github): retry in-progress lifecycle receipts

cd4e7d7

refactor(github): simplify lifecycle cleanup

622241e

Navigation Menu

Uh oh!

feat(github): share installations with web Cloud Agents (2/4) - #5978

feat(github): share installations with web Cloud Agents (2/4)#5978
pandemicsyn wants to merge 23 commits into
mainfrom
feat/github-connections-pr2

pandemicsyn commented Sep 8, 2026 •

edited

Loading

Uh oh!

kilo-code-bot Bot commented Sep 9, 2026 •

edited

Loading

Previous review (commit `f1bbbb4`)

Executive Summary

Overview

WARNING

Previous review (commit `458e94b`)

Executive Summary

Overview

WARNING

Previous review (commit `d70becc`)

Executive Summary

Overview

WARNING

Uh oh!

pandemicsyn commented Sep 9, 2026

Uh oh!

pandemicsyn commented Sep 9, 2026

Uh oh!

pandemicsyn commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pandemicsyn commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Authorization Boundaries

Simple Synchronous Lifecycle

Provider Reservation Boundary

Migration And Rollout

Verification

Uh oh!

kilo-code-bot Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit f1bbbb4)

Executive Summary

Overview

WARNING

Previous review (commit 458e94b)

Executive Summary

Overview

WARNING

Previous review (commit d70becc)

Executive Summary

Overview

WARNING

Uh oh!

pandemicsyn commented Sep 9, 2026

Uh oh!

pandemicsyn commented Sep 9, 2026

Uh oh!

pandemicsyn commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pandemicsyn commented Sep 8, 2026 •

edited

Loading

kilo-code-bot Bot commented Sep 9, 2026 •

edited

Loading

Previous review (commit `f1bbbb4`)

Previous review (commit `458e94b`)

Previous review (commit `d70becc`)