fix(cloud-agent): restore sends and workflow issuance with scoped tokens

[pandemicsyn]

Enabling scoped Cloud Agent tokens caused follow-up sends and resumes to fail: balance preflight forwarded a Cloud Agent control token to the general API balance endpoint, which rejected its audience. Add a dedicated Cloud Agent balance endpoint and route control tokens there. Balance checks and current user/organization authorization remain enforced; the general endpoint still rejects control tokens.

The new endpoint explicitly allows Cloud Agent control tokens to perform this one balance lookup, while retaining user, organization, and balance checks. We could have made a narrow exception in the existing endpoint. A separate endpoint makes the authorization boundary clearer and easier to test. So simplicity helped, but preserving scoped access was the main reason.

Workflow issuance also failed for users whose token pepper had never been initialized!

Some accounts had never had that value created. The new scoped-token issuer requires it, so background jobs such as code reviews threw an error instead of starting. We missed that compatibility case. The fix creates the value only when it’s missing, saves it, and uses the saved value to issue the token.

This doesn’t rotate existing peppers or reset everyone’s tokens.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental fix in 0a069e427 resolves the prior pepper-initialization finding: preparation now accepts the token families the caller actually issues, and security analysis requests both cloud-agent-next and workflow-gateway, so a missing pepper is initialized whenever either gate is enabled. No new issues were found in the changed code.

Files Reviewed (3 files)

• apps/web/src/lib/auth/cloud-agent-workflow-user.ts
• apps/web/src/lib/security-agent/services/analysis-service.ts
• apps/web/src/lib/security-agent/services/analysis-service.resource-tokens.test.ts

Previous Review Summary (commit a927eea)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit a927eea)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The dedicated Cloud Agent balance endpoint and worker audience-based routing correctly restore scoped control-token balance checks, but pepper initialization is keyed to only the cloud-agent-next family while the security-agent flow also issues an independently-gated workflow-gateway token.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/auth/cloud-agent-workflow-user.ts	8	Pepper initialization gated on cloud-agent-next only; generateWorkflowGatewayToken (independent workflow-gateway family) can still throw for null-pepper users

Files Reviewed (15 files)

• apps/web/src/app/api/cloud-agent-next/balance/route.ts - 0 issues
• apps/web/src/app/api/cloud-agent-next/balance/route.test.ts - 0 issues
• apps/web/src/app/api/cloud-agent-next/balance/route.auth.test.ts - 0 issues
• apps/web/src/lib/auth/cloud-agent-workflow-user.ts - 1 issue
• apps/web/src/lib/auth/cloud-agent-workflow-user.test.ts - 0 issues
• apps/web/src/lib/auto-fix/triggers/prepare-fix-payload.ts - 0 issues
• apps/web/src/lib/auto-fix/triggers/prepare-fix-payload.test.ts - 0 issues
• apps/web/src/lib/auto-triage/triggers/prepare-triage-payload.ts - 0 issues
• apps/web/src/lib/auto-triage/triggers/prepare-triage-payload.test.ts - 0 issues
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.ts - 0 issues
• apps/web/src/lib/security-agent/services/analysis-service.ts - 0 issues
• apps/web/src/lib/security-agent/services/analysis-service.test.ts - 0 issues
• apps/web/src/lib/security-agent/services/analysis-service.token-source.test.ts - 0 issues
• services/cloud-agent-next/src/balance-validation.ts - 0 issues
• services/cloud-agent-next/src/balance-validation.test.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 32.8K · Output: 5.9K · Cached: 352.5K}

_{Review guidance: REVIEW.md from base branch main}