feat(cloud-agent-next): authenticate git via a credential helper

[kilo-code-bot]

Summary

• Install a get-only kilo-git-credential helper and wire it through reserved GIT_CONFIG_* env so git auth comes from GH_TOKEN / GITLAB_TOKEN / BITBUCKET_TOKEN.
• Clone and keep GitHub/GitLab/Bitbucket origin as a canonical URL. Warm leftovers are stripped so URL-embedded creds cannot shadow the helper.
• Worker clone uses session.exec so the helper env is inherited. Generic remotes still embed a token because the helper has no host rule for them.
• Helper lives at /opt/kilo-cloud/kilo-git-credential (DIND-mounted) with a /usr/local/bin symlink. Profile GIT_CONFIG_* overrides are stripped.

Test plan

• pnpm exec vitest run src/kilo-git-credential.test.ts src/workspace.test.ts src/session-service.test.ts (192 passed)
• bun test src/session-bootstrap.test.ts (56 passed)
• Confirm a managed GitHub/GitLab/Bitbucket session clones with a clean origin and git ls-remote / submodule / LFS still auth via the helper
• Confirm a warm leftover tokenized origin is rewritten to the canonical URL
• Confirm a generic git.example.com remote still clones with an embedded token
• Confirm a DIND/devcontainer session can invoke /opt/kilo-cloud/kilo-git-credential

[kilo-code-bot]

Council Review

Advisory review — findings reported, no merge decision

Specialist votes: 0 block, 4 pass. Advisory mode records these votes but does not aggregate them into a decision.

Specialist	Model	Highest severity	Findings
Security	kilo/x-ai/grok-4.6	—	0
Performance	kilo/x-ai/grok-4.6	—	0
Test coverage	kilo/x-ai/grok-4.6	warning	2
Correctness	kilo/x-ai/grok-4.6	warning	2

Findings are counted per specialist; when specialists flag the same line their findings are grouped into one inline comment, so the inline comment count is lower than this total.
Governance mode: Advisory (report only) — the council reports findings but does not decide a merge verdict.

Code Review Summary

Status: 4 Issues Found | Recommendation: see the Council Review decision above

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/scripts/kilo-git-credential	21	Port stripping on GITLAB_HOST / requested host is untested
services/cloud-agent-next/src/session-service.ts	2629	type:git + platform:github clones without credentials
services/cloud-agent-next/wrapper/src/session-bootstrap.ts	334	Wrapper treats kind:git + platform:github as helper-backed without GH_TOKEN

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/workspace.ts	792	Helper-backed no-embed guard is not actually exercised

Files Reviewed (11 files)

• services/cloud-agent-next/Dockerfile
• services/cloud-agent-next/Dockerfile.dev
• services/cloud-agent-next/Dockerfile.dind
• services/cloud-agent-next/scripts/kilo-git-credential - 1 issue
• services/cloud-agent-next/src/kilo-git-credential.test.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts - 1 issue
• services/cloud-agent-next/src/workspace.test.ts
• services/cloud-agent-next/src/workspace.ts - 1 issue
• services/cloud-agent-next/wrapper/src/session-bootstrap.test.ts
• services/cloud-agent-next/wrapper/src/session-bootstrap.ts - 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by grok-4.6 · Input: 104.7K · Output: 24.3K · Cached: 713.3K}

_{Review guidance: REVIEW.md from base branch main}