feat(cloud-agent-next) bitbucket outbound creds injection

[St0rmz1]

Summary

Adds Bitbucket outbound credential injection for contained code-review
sessions, matching the existing GitHub and GitLab capability model. A
contained Bitbucket session no longer receives the raw workspace token.
Instead git-token-service mints an opaque, encrypted, container-bound
capability (kbb1. prefix) and the cloud-agent-next sandbox outbound
interceptor redeems it per request, attaching the real credential as a Basic
x-token-auth header. This lets Bitbucket use the same containment sandbox as
GitHub and GitLab.

The path is gated per organization by a new BITBUCKET_TOKEN_CONTAINMENT_ORG_IDS
allow-list and is off by default, so merging this ships the code dormant with no
behavior change until an org is enabled.

Changes

git-token-service (mint and redeem):

• New bitbucket-session-capability.ts: capability codec (kbb1. prefix,
  encrypted claims, 4h TTL, sha256 token digest, container and workspace/repo
  binding) with tests.
• index.ts: issueBitbucketSessionCapability and
  redeemBitbucketSessionCapability, plus validateBitbucketCapabilityUpstream,
  which restricts redemption to https://bitbucket.org/<repo>.git and rejects
  cross-repo and path-traversal requests (single and nested percent-encoded).
  Redeem re-resolves the token and compares digests, so a rotated token stops
  working.
• bitbucket-runtime-token-resolver.ts: resolveBitbucketCapabilitySubject
  returns the canonical workspace/repo identity (resolved by UUID) and current
  token.

cloud-agent-next (wiring and interceptor):

• sandbox-outbound.ts: handleManagedBitbucketOutbound recognizes kbb1.
  capabilities on bitbucket.org, matches the x-token-auth git-auth surface,
  and injects the redeemed credential, dispatched alongside the GitHub and
  GitLab handlers.
• session-service.ts: when credentialContainment.bitbucket is set, issue a
  capability instead of resolving the raw token, capture the canonical clone URL
  returned by issuance, and use it at every clone-URL site.
• session-registration.ts and session-metadata.ts: add the bitbucket
  containment dimension, gated by BITBUCKET_TOKEN_CONTAINMENT_ORG_IDS and repo
  type, and route contained Bitbucket sessions to the containment sandbox.
• types.ts and git-token-service-client.ts: RPC method signatures, result
  types, the new env binding, and the client wrapper.
• wrangler.jsonc: dev default for the new var (empty, off).

Verification

No manual end-to-end run was performed. The feature ships dormant behind the
org allow-list, so a live Bitbucket review will be smoke-tested after an org is
enabled post-deploy. Automated coverage: git-token-service unit tests
(issue/redeem, cross-repo rejection, single and double-encoded traversal
rejection, rotated-token rejection) and cloud-agent-next sandbox-outbound tests
(capability recognition and header injection).

• Manual Bitbucket review after enabling the allow-list (post-deploy)

Visual Changes

N/A

Reviewer Notes

• Ships dormant: BITBUCKET_TOKEN_CONTAINMENT_ORG_IDS is empty by default, so no
  Bitbucket session changes behavior until an org is added. GitHub and GitLab
  paths are untouched.
• validateBitbucketCapabilityUpstream is the security boundary. It
  deliberately rejects %2f (Bitbucket repo paths never encode slashes) where
  the GitLab validator must allow it (GitLab addresses projects by encoded
  path); see the inline comment. Both decode the path iteratively and re-check
  for traversal.
• The canonical clone URL from issuance is threaded through so a renamed or
  re-cased workspace does not mismatch the redeem-side repo check.
• Wrapper-side clone changes to actually use this on Bitbucket are a separate
  follow-up PR.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review: the only change since the last review is a mechanical test-file update (session-prepare.test.ts) adding the new bitbucket: false field to expected credentialContainment objects to match the schema change already reviewed; no new logic, security, or correctness issues found.

Files Reviewed (1 file)

• services/cloud-agent-next/src/session-prepare.test.ts

Previous Review Summary (commit ffc9e3b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit ffc9e3b)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the new Bitbucket outbound credential-injection capability flow (issue/redeem, path-traversal/origin validation, and containment wiring) across git-token-service and cloud-agent-next; found no high-confidence security, correctness, or logic issues in the changed lines.

Files Reviewed (13 files)

• services/git-token-service/src/bitbucket-session-capability.ts
• services/git-token-service/src/bitbucket-session-capability.test.ts
• services/git-token-service/src/bitbucket-runtime-token-resolver.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/index.test.ts
• services/cloud-agent-next/src/sandbox-outbound.ts
• services/cloud-agent-next/src/sandbox-outbound.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/services/git-token-service-client.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/types.ts
• services/cloud-agent-next/wrangler.jsonc

---

_{Reviewed by claude-sonnet-5 · Input: 14 · Output: 2.2K · Cached: 243.4K}

_{Review guidance: REVIEW.md from base branch main}