feat(auth): add gated mobile and Chat token issuance by pandemicsyn · Pull Request #5976 · Kilo-Org/cloud

pandemicsyn · 2026-09-08T17:10:29Z

Summary

Add gated scoped-token issuance for native/mobile and Chat/Events/Notifications.

Mobile retains legacy login, refresh, storage, and request authentication when native adoption is off, including when the shared Web master is on. Negotiated bundles select API/gateway credentials for model and voice requests. No pepper initialization or rotation is introduced.

Verification

No physical-device or deployed provider/container smoke tests were run. Automated coverage and source comparison validate the extraction; device and deployed consumer checks remain necessary before activating the relevant family.

Visual Changes

N/A — credential handling changes do not add a visual interface.

Reviewer Notes

No new flag needs enabling when this merges. Preserve existing Cloud Agent settings.

Feature toggles	Default	Where to configure
`NATIVE_RESOURCE_TOKENS_ENABLED`, `CHAT_RESOURCE_TOKENS_ENABLED`	Off: unset or `false`	Vercel — Web environment variables; redeploy Web after changes

Web SHARED_RESOURCE_TOKENS_ENABLED is already enabled; each family still requires its own flag. Keep native adoption off until physical-device smoke coverage passes. Chat source-authority checks still apply with issuance off. Retain compatible readers/runtime support during rollback.

Prior validation of the unchanged retained code: 811 mobile tests and 13 shared native contract tests passed, with affected typechecks/lint and mobile unused-export checks. Remaining Web typecheck passed after extraction. This extraction changes no remaining application code; full repository or live smoke validation is not claimed.

Explicit resource delegation and its legacy compatibility fix are now #6155. Security Auto Analysis is #6147. Gastown and Wasteland are #6141; benchmark is #6157; Webhook Ingest shipped in #6142. These changes originated in #5857. The remaining PR targets main independently. Cloud Agent Next transport changes are outside this PR.

Consumer audit · Rollout settings.

kilo-code-bot · 2026-09-08T17:44:18Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commit extracts Security Auto Analysis into a separate PR, reverting the services/security-auto-analysis tree to main behavior (verified byte-identical) and updating the rollout docs to drop its settings and coverage references; no defects were found in the changed code.

Files Reviewed (15 files)

docs/token-consumer-audit.md
docs/token-issuance-policy.md
services/security-auto-analysis/src/callbacks.ts
services/security-auto-analysis/src/callbacks.lifecycle.test.ts
services/security-auto-analysis/src/db/queries.ts
services/security-auto-analysis/src/launch.ts
services/security-auto-analysis/src/launch.test.ts
services/security-auto-analysis/src/manual-analysis.ts
services/security-auto-analysis/src/remediation.ts
services/security-auto-analysis/src/session-result.ts
services/security-auto-analysis/src/token.ts
services/security-auto-analysis/src/token.test.ts (deleted)
services/security-auto-analysis/src/token-runtime-compat.test.ts (deleted)
services/security-auto-analysis/worker-configuration.d.ts
services/security-auto-analysis/wrangler.jsonc

Previous Review Summaries (5 snapshots, latest commit 0161d1c)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `0161d1c`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commit extracts Gastown and Webhook Agent Ingest issuance into separate PRs, reverting those branches to main behavior and updating the retained delegation test and rollout docs to match; the retained changes were verified against current code and no defects were found.

Files Reviewed (3 files)

apps/web/src/lib/auth/resource-delegation.test.ts
docs/token-consumer-audit.md
docs/token-issuance-policy.md

Previous review (commit `edde179`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The four follow-up commits since the previous review (mobile legacy-token behavior with native adoption off, remaining-family consumer contracts, Gastown pepper/runtime-renewal fencing, and rollout docs) were inspected in full; no new defects were found in the changed code.

Files Reviewed (39 files)

apps/mobile/src/lib/auth/credentials.ts
apps/mobile/src/lib/auth/native-credential-lifecycle.test.ts
apps/mobile/src/lib/hooks/use-transcription-models.ts
apps/mobile/src/lib/hooks/use-transcription-models.test.ts
apps/mobile/src/lib/voice-input/gateway/native-gateway-voice-input.ts
apps/mobile/src/lib/voice-input/gateway/native-gateway-voice-input.test.ts
apps/web/src/app/api/auth/native/token/route.credentials.integration.test.ts
apps/web/src/app/api/device-auth/token/route.flagoff.integration.test.ts
apps/web/src/lib/auth/native-access-credentials.test.ts
apps/web/src/app/api/auth/resource-token/route.ts
apps/web/src/app/api/auth/resource-token/route.test.ts
apps/web/src/app/api/gastown/token/route.ts
apps/web/src/lib/auth/resource-delegation.ts
apps/web/src/lib/auth/resource-delegation.test.ts
apps/web/src/lib/kilo-chat/token.test.ts
services/auto-routing-benchmark/container/server.mjs
services/auto-routing-benchmark/src/container-auth.test.ts
services/security-auto-analysis/src/token-runtime-compat.test.ts
services/webhook-agent-ingest/src/queue-consumer.test.ts
services/webhook-agent-ingest/src/services/token-minting-service.test.ts
services/gastown/src/dos/Town.do.ts
services/gastown/src/dos/town/legacy-token-renewal.ts
services/gastown/src/dos/town/legacy-token-renewal.test.ts
services/gastown/src/dos/town/runtime-authorization.ts
services/gastown/src/dos/town/runtime-authorization.test.ts
services/gastown/src/dos/town/runtime-downstream-contract.test.ts
services/gastown/src/dos/town/unattended-token-renewal.ts
services/gastown/src/dos/town/unattended-token-renewal.test.ts
services/gastown/src/gastown.worker.ts
services/gastown/src/middleware/kilo-auth.middleware.ts
services/gastown/src/middleware/kilo-auth.middleware.test.ts
services/gastown/src/trpc/town-authorization.router.test.ts
services/gastown/src/util/token-pepper.util.ts
services/gastown/src/util/town-authorization.util.ts
services/gastown/src/util/town-authorization.util.test.ts
services/gastown/test/integration/town-private-identity.test.ts
ENVIRONMENT.md
docs/token-consumer-audit.md
docs/token-issuance-policy.md

Previous review (commit `4ccf1ff`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (109 files)

apps/mobile/src/lib/auth/auth-context.tsx
apps/mobile/src/lib/auth/credentials.ts
apps/mobile/src/lib/auth/native-auth-contract.ts
apps/mobile/src/lib/auth/token-owner.ts
apps/mobile/src/lib/auth/use-native-auth.ts
apps/mobile/src/lib/auth/use-auth-bootstrap.ts
apps/web/src/app/api/auth/native/token/route.ts
apps/web/src/app/api/auth/native/exchange/route.ts
apps/web/src/app/api/auth/native/refresh/route.ts
apps/web/src/app/api/auth/resource-token/route.ts
apps/web/src/app/api/device-auth/token/route.ts
apps/web/src/app/api/gastown/token/route.ts
apps/web/src/app/api/wasteland/token/route.ts
apps/web/src/app/api/kilo-chat/token/route.ts
apps/web/src/app/api/organizations/[id]/user-tokens/route.ts
apps/web/src/app/api/internal/auto-routing-benchmark/token/route.ts
apps/web/src/lib/auth/native-access-credentials.ts
apps/web/src/lib/auth/device-sessions.ts
apps/web/src/lib/kilo-chat/token.ts
packages/app-shared/src/native-auth.ts
services/gastown/src/dos/Town.do.ts
services/gastown/src/dos/town/runtime-authorization.ts
services/gastown/src/dos/town/unattended-token-renewal.ts
services/gastown/src/dos/town/legacy-token-renewal.ts
services/gastown/src/middleware/town-auth.middleware.ts
services/gastown/src/middleware/org-auth.middleware.ts
services/gastown/src/handlers/town-runtime-authorization.handler.ts
services/gastown/src/handlers/org-towns.handler.ts
services/gastown/src/util/town-authorization.util.ts
services/gastown/src/trpc/router.ts
services/security-auto-analysis/src/token.ts
services/webhook-agent-ingest/src/services/token-minting-service.ts
docs/token-issuance-policy.md
Remaining mobile/web/gastown/worker tests, wrangler defaults, and generated types

Previous review (commit `7a29996`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

apps/mobile/src/lib/auth/native-auth-contract.ts
services/gastown/src/dos/Town.do.ts
services/gastown/src/dos/town/runtime-authorization.ts
services/gastown/src/dos/town/runtime-authorization.test.ts
services/gastown/src/dos/town/unattended-token-renewal.ts
services/gastown/src/dos/town/unattended-token-renewal.test.ts
services/gastown/src/middleware/town-auth.middleware.ts
services/gastown/src/middleware/town-auth.middleware.test.ts
services/gastown/test/integration/town-private-identity.test.ts
services/security-auto-analysis/src/token.ts

Previous review (commit `287ed27`)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`services/gastown/src/middleware/town-auth.middleware.ts`	45	Admin bypass skipped for unmigrated towns
`services/gastown/src/dos/town/runtime-authorization.ts`	157	Split DO writes can brick a town as invalid
`services/gastown/src/dos/town/runtime-authorization.ts`	155	Org reauthorize requires original creator, not current owner

Files Reviewed (109 files)

services/gastown/src/middleware/town-auth.middleware.ts - 1 issue
services/gastown/src/dos/town/runtime-authorization.ts - 2 issues
apps/mobile/src/lib/auth/* and related mobile auth call sites
apps/web/src/app/api/auth/native/*, device-auth, resource-token, gastown/token, wasteland/token, kilo-chat/token, organizations/*/user-tokens, benchmark token routes
packages/app-shared/src/native-auth.ts
services/gastown remaining handlers, middleware, tRPC, renewal, and tests
services/security-auto-analysis token minting and wrangler defaults
services/webhook-agent-ingest token minting, callbacks, wrangler defaults
docs/token-issuance-policy.md
Generated worker-configuration.d.ts and pnpm-lock.yaml skipped for findings

Fix these issues in Kilo Cloud

_{Reviewed by deepseek-v4.1-flash · Input: 46.3K · Output: 8.3K · Cached: 501.9K}

_{Review guidance: REVIEW.md from base branch main}

… PRs

This was referenced Sep 8, 2026

feat(auth): shared token foundation (1/3) #5974

Merged

feat(cloud-agent): scoped runtime credentials (2/3) #5975

Merged

pandemicsyn marked this pull request as ready for review September 8, 2026 17:24

kilo-code-bot Bot reviewed Sep 8, 2026

View reviewed changes

Comment thread services/gastown/src/middleware/town-auth.middleware.ts Outdated

Comment thread services/gastown/src/dos/town/runtime-authorization.ts Outdated

Comment thread services/gastown/src/dos/town/runtime-authorization.ts Outdated

intentionally-left-nil approved these changes Sep 8, 2026

View reviewed changes

Comment thread services/gastown/src/dos/town/unattended-token-renewal.ts Outdated

Base automatically changed from split/token-cloud-agent to main September 10, 2026 15:04

pandemicsyn added 5 commits September 10, 2026 10:04

feat(auth): extract remaining token families

c9f48ca

docs(auth): clarify stacked rollout and issuance defaults

e453510

refactor(auth): remove unused additions from token rollout

d20fb1d

fix(gastown): retain admin access to unmigrated towns

7351ece

fix(gastown): harden runtime reauthorization and legacy renewal

4ccf1ff

pandemicsyn force-pushed the split/token-other-families branch from 58fb880 to 4ccf1ff Compare September 10, 2026 15:04

pandemicsyn added 8 commits September 10, 2026 16:35

Merge main into remaining token families

f619a46

Merge current main into remaining token families

0fb74be

Merge main before final token-family compatibility review

c254a98

fix(auth): preserve mobile behavior with native adoption disabled

16d32fa

fix(auth): enforce remaining-family consumer contracts

2c2a55e

fix(gastown): preserve legacy peppers and fence runtime renewal

45ccd5b

docs(auth): clarify remaining-family rollout and consumer coverage

edde179

refactor(auth): extract Gastown and webhook issuance into independent…

0161d1c

… PRs

pandemicsyn changed the title ~~feat(auth): remaining token families (3/3)~~ feat(auth): mobile and remaining scoped-token consumers Sep 14, 2026

This was referenced Sep 14, 2026

feat(gastown): add gated Gastown and Wasteland token issuance #6141

Open

feat(webhooks): add gated automation token issuance #6142

Merged

refactor(auth): extract Security Auto Analysis into its own PR

e64d1a5

pandemicsyn mentioned this pull request Sep 14, 2026

feat(security-auto-analysis): add gated scoped analysis credentials #6147

Merged

refactor(auth): extract explicit resource delegation from mobile PR

c159f0f

pandemicsyn mentioned this pull request Sep 14, 2026

feat(auth): add explicit delegation with legacy compatibility #6155

Open

refactor(auth): extract benchmark and move Wasteland to Gastown PR

c8c4f97

pandemicsyn mentioned this pull request Sep 14, 2026

feat(benchmark): add gated resource token issuance #6157

Open

pandemicsyn changed the title ~~feat(auth): mobile and remaining scoped-token consumers~~ feat(auth): add gated mobile and Chat token issuance Sep 14, 2026

Merge main and migrate device approval test to mounted renderer

6c3e4f2

Navigation Menu

Uh oh!

feat(auth): add gated mobile and Chat token issuance - #5976

feat(auth): add gated mobile and Chat token issuance#5976
pandemicsyn wants to merge 17 commits into
mainfrom
split/token-other-families

pandemicsyn commented Sep 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Sep 8, 2026 •

edited

Loading

Previous review (commit `0161d1c`)

Executive Summary

Previous review (commit `edde179`)

Executive Summary

Previous review (commit `4ccf1ff`)

Previous review (commit `7a29996`)

Previous review (commit `287ed27`)

Overview

WARNING

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

pandemicsyn commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Visual Changes

Reviewer Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit 0161d1c)

Executive Summary

Previous review (commit edde179)

Executive Summary

Previous review (commit 4ccf1ff)

Previous review (commit 7a29996)

Previous review (commit 287ed27)

Overview

WARNING

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pandemicsyn commented Sep 8, 2026 •

edited

Loading

kilo-code-bot Bot commented Sep 8, 2026 •

edited

Loading

Previous review (commit `0161d1c`)

Previous review (commit `edde179`)

Previous review (commit `4ccf1ff`)

Previous review (commit `7a29996`)

Previous review (commit `287ed27`)