[eshurakov]

Summary

Add customer-paid Vercel compute to Cloud Agent. Users and organization administrators can connect a scoped Vercel token, choose a team/project, build and validate a runtime snapshot, and select Vercel sandbox sizes in Cloud Agent settings.

• Store provider credentials encrypted and enforce owner isolation throughout session admission and runtime access.
• Support cold starts, warm follow-ups, automatic idle shutdown, recovery, and credential/resource removal.
• Support opt-in downloaded Kilo releases on a reusable Vercel snapshot. CLI/control updates select a new immutable release without rebuilding the compatible base.
• Gate enrollment with one Worker environment variable, BYOC_VERCEL_IDS, containing comma-separated user or organization IDs. Configure 9d278969-5453-4ae3-a51f-a8d2274a7b56 as the initial organization. Empty disables enrollment.

Verification

• Local stack with a real Vercel test project: token setup, credential isolation, cold/warm chat, Stop, automatic ten-minute idle shutdown, recovery, and resource cleanup.
• Real downloaded Kilo 7.8.1 → 7.8.2 on the same snapshot, with no new builder.
• Controlled missing-snapshot, unavailable-download, and corrupt-download failures; recovery verified.

Live provider qualification preceded the final rebase. Automated validation after the review fixes is listed below.

Visual Changes

Cloud Agent settings → Compute: connect Vercel, choose a project, follow setup, choose a sandbox size, and remove credentials.

The UI demo uses a masked sample credential and replayed provider responses. No tokens are visible.

Reviewer Notes

Rebased onto main and squashed into one feature commit. The PR adds one PostgreSQL migration and one initial SQLite migration for the new snapshot-build Durable Object.

Snapshot builds preserve validated snapshots when terminal validators disappear or old-snapshot cleanup fails. Projection failures use bounded backoff. Credential requests reject redirects, setup retry requires a failed setup, and insert errors distinguish owner conflicts from temporary storage failures. Main's active event sanitizer replaces the unused duplicate. Implicit BYOC registration rejects unsupported repository and tool capabilities before admission. HTTP 429 create rejections clear their intents, failed generation handovers schedule cleanup, and MCP excludes credential entry and resource mutations. Ambiguous provider create outcomes retain ownership until confirmed cleanup or explicit owner acknowledgement.

Current head b56a7e1d03: all 82 checks pass, with two intentional skips. All 19 review threads are resolved. CI validation: all 5,728 Worker unit tests (208 suites), all 626 Worker integration tests (24 suites), web tests, builds, typechecks, lint, and Chrome E2E pass. Local validation also covers 420 focused Worker tests, 53 MCP catalog tests, 44 PostgreSQL-backed compute-router tests, schema consistency, formatting, and git diff --check. Browser verification uses controlled status-query failure and recovery responses: Retry restores the setup form.

The enrollment value is configured in the PR; no deployment was performed. Downloaded startup remains opt-in. Older snapshots need one compatibility update. Node, Bun, OS, ABI, or filesystem-layout changes still require a base snapshot update.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up delta (10 files) correctly closes the previously reported gaps: BYOC owners are now gated on repository type and provider capability before admission, rate-limited create rejections clear their intent so terminal cleanup can finish, a failed generation handover persists the cleanup step and arms its alarm, the Vercel credential mutations are withheld from the MCP catalog, the view-only notice is section-agnostic, and the kill-switch runbook names BYOC_VERCEL_IDS.

Assumptions: [INFERENCE] The previously reviewed SHA ad44955922549929303d4784f34441ad577d899c is not an ancestor of HEAD (the branch was squashed into b56a7e1d03), so the incremental diff was taken as git diff ad449559..HEAD (10 files, 159 insertions, 392 deletions); gh pr diff still exceeds GitHub's 20,000-line limit and was unavailable. No tests were run. The prior sandbox-do.ts:753 transaction suggestion was dropped: that file is unchanged in this delta and the author's Cloudflare SQLite transaction semantics (all ctx.storage operations, including SQL, inside transaction()) make the nested Drizzle savepoint a non-issue. Since the delta is small, no sub-agents were used.

Files Reviewed (10 files)

• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts
• services/cloud-agent-next/src/persistence/VercelSnapshotBuild.test.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• apps/web/src/components/cloud-agent-next/settings/CloudAgentSettingsDialog.tsx
• apps/web/src/scripts/mcp-catalog/catalog.ts
• apps/web/src/scripts/mcp-catalog/catalog.test.ts
• services/kilo-mcp/catalog.json
• services/cloud-agent-next/worker-configuration.d.ts
• docs/byoc-vercel-implementation-plan.md

Previous Review Summaries (3 snapshots, latest commit ad44955)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit ad44955)

Status: 7 Issues Found | Recommendation: Address before merge

Executive Summary

The highest-risk issues are that BYOC enrollment forces every new session onto Vercel even when the repository or provider capability is ineligible, and that a retryable sandbox-create rejection leaves a create intent that terminal cleanup can never resolve, producing an unbounded 60s alarm loop.

Assumptions: [INFERENCE] gh pr diff still exceeds GitHub's 20,000-line limit, and the previously reviewed SHA is not an ancestor of HEAD (the branch was rebased/squashed), so this run used a full review of git diff 01ba362828..HEAD (134 files) plus full head files; no tests were run. Vercel 404/410 stop semantics and 429 create-failure behavior are inferred from this PR's own handling, not verified against the live API. The six findings from the previous review were re-read on current HEAD and are fixed: replayed start re-arms, definitive rejected creates clear the intent, confirm_terminal accepts 404/410, previous-snapshot deletion is best effort, step transitions preserve retry_count, all secret-bearing resolver fetches use redirect: 'manual', retrySetup requires failed status, insert errors map only unique violations to CONFLICT, the status panel has Retry, listSnapshots paginates, and both deploy jobs pin Bun 1.4.4.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	4

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/session/session-registration.ts	854	BYOC enrollment forces vercel without the repository/capability gates, so GitLab/Bitbucket/Git and remediation sessions are admitted and then fail in workspace setup
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	967	A 429/5xx create rejection retains the create intent while no sandbox exists, so removeManagedSession throws forever and terminal cleanup re-arms every 60s with no attempt cap
services/kilo-mcp/catalog.json	27633	vercelCompute.add/remove/retrySetup/upgradeRuntime (org and personal) are newly published MCP mutations that write secrets, delete credentials, or trigger builds, with no denylist entry or PR rationale

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	382	A failed generation handover persists next_attempt_at: null and never arms, leaving old resources referenced and the build stuck in building
services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts	753	Validator adoption's ctx.storage.transaction does not cover the SQL writes (writeAllocation opens its own transaction), so a partial failure can persist a BYOC pin with stopped state and permanently block adoption
apps/web/src/components/cloud-agent-next/settings/CloudAgentSettingsDialog.tsx	83	The view-only notice keys off section instead of activeSection, hiding it on the Environments tab and on the compute deep-link fallback
docs/byoc-vercel-implementation-plan.md	1044	The kill-switch runbook names BYOC_VERCEL_ORG_IDS, which no code reads; the implementation uses BYOC_VERCEL_IDS

Files Reviewed (134 files)

• services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts - 2 issues
• services/cloud-agent-next/src/session/session-registration.ts - 1 issue
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts - 1 issue
• apps/web/src/components/cloud-agent-next/settings/CloudAgentSettingsDialog.tsx - 1 issue
• services/kilo-mcp/catalog.json - 1 issue
• docs/byoc-vercel-implementation-plan.md - 1 issue
• services/cloud-agent-next/src/byoc/**, sandbox-control/**, agent-sandbox/vercel/**, session/**, control-plane/session/**, shared/**, server.ts, types.ts, sandbox-id.ts, sandbox-selection.ts, sandbox-provider-binding.ts - no additional issues
• apps/web/src/routers/organizations/**, lib/vercel-client.ts, lib/cloud-agent-next/**, hooks/useVercelComputeData.ts, components/cloud-agent-next/settings/**, app/api/internal/byoc/**, lib/user/index.ts - no additional issues
• packages/db/src/migrations/0302_*.sql (new empty table, safe DDL), schema.ts, schema-types.ts, services/cloud-agent-next/drizzle/vercel-snapshot/**, wrangler.jsonc, worker-configuration.d.ts - no additional issues
• Remaining docs, tests, and generated snapshots/journals - excluded from issue scope

Fix these issues in Kilo Cloud

Previous review (commit 37566eb)

Status: 6 Issues Found | Recommendation: Address before merge

Executive Summary

The six findings from the previous review are verified fixed on the current HEAD; the remaining risk is in the BYOC snapshot-build state machine, where a validator session that was already gone when stopped deterministically fails the build and deletes the freshly created snapshot, plus smaller recovery/retry gaps.

Assumptions: [INFERENCE] gh pr diff exceeds GitHub's 20,000-line limit, so the review used the base..head git diff (134 files) plus full head files; no test suites were run. The 404 semantics for a stopped/expired Vercel session were inferred from this PR's own 404/410 handling in stopBuildSession, not verified against the live API. The fixes claimed for the prior six findings were re-read in current code and are correct: start re-arms a persisted build, definitive rejected creates clear the create intent, listSnapshots paginates, both deploy jobs pin Bun 1.4.4, the status-query error/Retry UI exists, and publicEventProperties is applied to persisted and live event payloads.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	5

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	918	confirm_terminal treats a 404 from getSession as fatal even though stopBuildSession accepts 404/410 as already-terminal, so a completed build is marked failed and its new snapshot deleted

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	565	A non-404 failure deleting the previous generation's snapshot demotes an already-ready build and deletes the new snapshot
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	1045	next() resets retry_count before projection, so projection failures retry forever at ~1s instead of exhausting the budget
services/cloud-agent-next/src/byoc/vercel-credential-resolver.ts	194	Internal x-internal-api-key fetches follow redirects (unlike the REST client's redirect: 'manual'), so the secret can be forwarded cross-origin
apps/web/src/routers/organizations/organization-vercel-compute-router.ts	395	retrySetup lacks the failed-status precondition, so it can delete a ready snapshot and reset a healthy credential
apps/web/src/routers/organizations/organization-vercel-compute-router.ts	379	Any insert failure is surfaced as 409 "already configured" instead of only a unique-violation

Files Reviewed (134 files)

• services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts - 3 issues
• services/cloud-agent-next/src/byoc/vercel-credential-resolver.ts - 1 issue
• apps/web/src/routers/organizations/organization-vercel-compute-router.ts - 2 issues
• services/cloud-agent-next/src/sandbox-control/**, agent-sandbox/vercel/**, byoc/** - no additional issues
• services/cloud-agent-next/src/control-plane/**, session/**, sandbox-session/**, shared/**, server.ts, router/**, types.ts, session-profile.ts - no additional issues
• apps/web/src/components/cloud-agent-next/settings/**, hooks/useVercelComputeData.ts, lib/vercel-client.ts, lib/cloud-agent-next/**, app/api/internal/byoc/**, routers/**, lib/user/** - no additional issues
• packages/db/src/migrations/0301_cooing_kate_bishop.sql (new empty table, safe non-concurrent DDL), packages/db/src/schema.ts, schema-types.ts, drizzle/vercel-snapshot/** - no issues
• packages/worker-utils/src/sandbox-allocation.ts, .github/workflows/**, ENVIRONMENT.md, docs/**, services/kilo-mcp/catalog.json - no issues
• Tests and generated snapshots/journals/catalog formatting - excluded from issue scope

Fix these issues in Kilo Cloud

Previous review (commit 0a2f8b4)

Status: 6 Issues Found | Recommendation: Address before merge

Executive Summary

The highest-risk problems are in the BYOC snapshot-build lifecycle: a sandbox create that was requested but never materialised makes cleanup unrecoverable (permanent alarm loop plus a permanently failing retrySetup), and a replayed start can leave a persisted build with no alarm at all. Owner isolation, credential encryption/AAD binding, internal-route auth, and the new PostgreSQL migration look sound.

Assumptions: [INFERENCE] gh pr diff failed because the diff exceeds GitHub's 20,000-line limit, so the review used the base..head git diff plus full head files; test suites were not run. Vercel snapshot-stop and pagination semantics were taken from the implementation-plan docs and the reference script, not verified against the live API. No full security chain was proven; remaining concerns (weak org owner assertion in cleanupExistingVercelBuild, unvalidated non-HTTPS provider targets for Vercel grants, projectByocVercelSnapshotMissing masking a resolver error) are inference-level and not raised as findings.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	3

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	1206	Persisted create intent plus a definitively failed provider create makes cleanup throw forever; the alarm re-arms every 60s, the row is never erased, and retrySetup/cleanup() stay 502
services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts	326	A replayed start returns on same-ownership without arming; if the row was saved before arm() (e.g. handover throws) the build has null next_attempt_at and no alarm
services/cloud-agent-next/src/sandbox-session/sandbox-control-event.ts	107	sanitizeControlSessionEvent is never called, so session.error/live message.updated payloads still persist and broadcast raw provider error objects

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts	464	listSnapshots hard-limits to 50 with no pagination while callers treat the page as the complete set, risking missed cleanup and failed recovery
.github/workflows/deploy-workers.yml	74	Deploy job installs mutable bun-version: latest (second occurrence ~327) while CI/runtime-publish pin 1.3.14; this builds the embedded wrapper
apps/web/src/components/cloud-agent-next/settings/VercelComputeSettings.tsx	831	A failed getStatus query renders an empty panel with no error or retry, unlike the enrollment error states

Files Reviewed (133 changed files)

• services/cloud-agent-next/src/persistence/VercelSnapshotBuild.ts - 2 issues
• services/cloud-agent-next/src/sandbox-session/sandbox-control-event.ts - 1 issue
• services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts - 1 issue
• .github/workflows/deploy-workers.yml - 1 issue
• apps/web/src/components/cloud-agent-next/settings/VercelComputeSettings.tsx - 1 issue
• apps/web/src/app/api/internal/byoc/vercel-credentials/** - no issues
• apps/web/src/routers/organizations/organization-vercel-compute-router.ts - no issues
• apps/web/src/routers/organizations/organization-router.ts, apps/web/src/routers/root-router.ts - no issues
• apps/web/src/hooks/useVercelComputeData.ts - no issues
• apps/web/src/lib/vercel-client.ts, apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts - no issues
• apps/web/src/lib/cloud-agent-next/vercel-compute-status.ts - no issues
• apps/web/src/lib/cloud-agent-next/sandbox-allocation-offers.ts, settings/sandbox-selection files - no issues
• services/cloud-agent-next/src/byoc/** (owner, resolver, provider, runtime identity/base/artifacts, stub) - no issues
• services/cloud-agent-next/src/sandbox-control/** (provider, vercel-provider, session-credentials, startup-selection, downloaded-startup) - no issues
• services/cloud-agent-next/src/control-plane/sandbox/sandbox-do.ts, snapshot-validator.ts - no issues
• services/cloud-agent-next/src/control-plane/session/**, persistence/session-metadata.ts - no issues
• services/cloud-agent-next/src/sandbox-selection.ts, src/sandbox-id.ts, src/sandbox-provider-binding.ts - no issues
• services/cloud-agent-next/src/session/** (registration, control-plane input, allocation resolution) - no issues
• services/cloud-agent-next/src/server.ts, src/router/schemas.ts, src/router/handlers/session-worktree.ts - no issues
• services/cloud-agent-next/src/kilo/runtime-credential-proxy-routes.ts, src/session-profile.ts, src/types.ts - no issues
• services/cloud-agent-next/wrangler.jsonc, .dev.vars.example, drizzle/vercel-snapshot/** - no issues
• packages/db/src/schema.ts, schema-types.ts, migrations/0297_lazy_polaris.sql - no issues
• packages/worker-utils/src/sandbox-allocation.ts - no issues
• docs/**, ENVIRONMENT.md, .kilo/skills/kilo-mcp/SKILL.md - no issues (no images introduced)
• Test files and generated snapshots/journals/catalog - excluded from issue scope

---

_{Reviewed by deepseek-flash-latest · Input: 107.2K · Output: 24.8K · Cached: 2.4M}

_{Review guidance: REVIEW.md from base branch main}