feat(slack): support shared GitHub Cloud Agent workflows

apps/web/src/app/api/webhooks/github-lite/route.ts

@@ -1,6 +1,13 @@
 import type { NextRequest } from 'next/server';
 import { handleGitHubWebhook } from '@/lib/integrations/platforms/github/webhook-handler';
 
+/**
+ * Must stay strictly below GITHUB_INSTALLATION_DELIVERY_STALE_CLAIM_MS (10 minutes).
+ * The shared handler reclaims a `processing` delivery receipt once it is older than
+ * that window, so a dispatch allowed to run longer could be reclaimed and double-processed.
+ */
+export const maxDuration = 300;
+
 /**
  * GitHub Lite App Webhook Handler
  *

apps/web/src/app/api/webhooks/github/route.test.ts

@@ -33,7 +33,9 @@ jest.mock('@/lib/integrations/github/runtime-authorization', () => ({
     mockAssertRuntimeAuthorized(installationId, appType),
 }));
 
-import { POST } from './route';
+import { maxDuration, POST } from './route';
+import { maxDuration as liteMaxDuration } from '../github-lite/route';
+import { GITHUB_INSTALLATION_DELIVERY_STALE_CLAIM_MS } from '@/lib/integrations/db/github-installations';
 import { GitHubRuntimeAuthorizationError } from '@/lib/integrations/github/runtime-authorization';
 
 function githubRequest(
@@ -143,3 +145,11 @@ describe('GitHub webhook route', () => {
     expect(mockGithubWebhook).not.toHaveBeenCalled();
   });
 });
+
+describe('GitHub webhook delivery-claim window', () => {
+  it('keeps every webhook route maxDuration below the stale-claim reclaim window', () => {
+    const staleWindowMs = GITHUB_INSTALLATION_DELIVERY_STALE_CLAIM_MS;
+    expect(maxDuration * 1000).toBeLessThan(staleWindowMs);
+    expect(liteMaxDuration * 1000).toBeLessThan(staleWindowMs);
+  });
+});

apps/web/src/app/api/webhooks/github/route.ts

@@ -35,6 +35,13 @@ function getGitHubInstallationId(rawBody: string): string | null {
   return null;
 }
 
+/**
+ * Must stay strictly below GITHUB_INSTALLATION_DELIVERY_STALE_CLAIM_MS (10 minutes).
+ * The shared handler reclaims a `processing` delivery receipt once it is older than
+ * that window, so a dispatch allowed to run longer could be reclaimed and double-processed.
+ */
+export const maxDuration = 300;
+
 /**
  * GitHub App Webhook Handler (Standard App)
  *

apps/web/src/lib/bot/tools/spawn-cloud-agent-session.test.ts

@@ -2,18 +2,18 @@ import { beforeAll, beforeEach, describe, expect, it, jest } from '@jest/globals
 import type { PlatformIntegration } from '@kilocode/db';
 import type { CloudAgentAttachments } from '@/lib/cloud-agent/constants';
 import type { createCloudAgentNextClient as CreateCloudAgentNextClient } from '@/lib/cloud-agent-next/cloud-agent-client';
-import type {
-  getGitHubTokenForOrganization as GetGitHubTokenForOrganization,
-  getGitHubTokenForUser as GetGitHubTokenForUser,
-} from '@/lib/cloud-agent/github-integration-helpers';
 import type {
   buildGitLabCloneUrl as BuildGitLabCloneUrl,
   getGitLabInstanceUrlForUser as GetGitLabInstanceUrlForUser,
   getGitLabTokenForUser as GetGitLabTokenForUser,
 } from '@/lib/cloud-agent/gitlab-integration-helpers';
 import type { resolveModelForGitHubRepository as ResolveModelForGitHubRepository } from '@/lib/integrations/github-repository-settings';
+import type { resolveGitHubRepositoryForOwner as ResolveGitHubRepositoryForOwner } from '@/lib/slack-bot/github-repository-context';
 import type SpawnCloudAgentSession from './spawn-cloud-agent-session';
 
+const mockGetGitHubIntegrationById =
+  jest.fn<(...args: unknown[]) => Promise<PlatformIntegration | null>>();
+
 jest.mock('@/lib/config.server', () => ({
   CALLBACK_TOKEN_SECRET: 'callback-secret',
 }));
@@ -26,9 +26,12 @@ jest.mock('@/lib/cloud-agent-next/cloud-agent-client', () => ({
   createCloudAgentNextClient: jest.fn(),
 }));
 
-jest.mock('@/lib/cloud-agent/github-integration-helpers', () => ({
-  getGitHubTokenForOrganization: jest.fn(),
-  getGitHubTokenForUser: jest.fn(),
+jest.mock('@/lib/slack-bot/github-repository-context', () => ({
+  resolveGitHubRepositoryForOwner: jest.fn(),
+}));
+
+jest.mock('@/lib/integrations/db/platform-integrations', () => ({
+  getGitHubIntegrationById: (...args: unknown[]) => mockGetGitHubIntegrationById(...args),
 }));
 
 jest.mock('@/lib/cloud-agent/gitlab-integration-helpers', () => ({
@@ -73,8 +76,9 @@ const mockPrepareSession =
 const mockInitiateFromPreparedSession = jest.fn<(input: unknown) => Promise<unknown>>();
 let spawnCloudAgentSession: typeof SpawnCloudAgentSession;
 let mockCreateCloudAgentNextClient: jest.MockedFunction<typeof CreateCloudAgentNextClient>;
-let mockGetGitHubTokenForOrganization: jest.MockedFunction<typeof GetGitHubTokenForOrganization>;
-let mockGetGitHubTokenForUser: jest.MockedFunction<typeof GetGitHubTokenForUser>;
+let mockResolveGitHubRepositoryForOwner: jest.MockedFunction<
+  typeof ResolveGitHubRepositoryForOwner
+>;
 let mockGetGitLabTokenForUser: jest.MockedFunction<typeof GetGitLabTokenForUser>;
 let mockGetGitLabInstanceUrlForUser: jest.MockedFunction<typeof GetGitLabInstanceUrlForUser>;
 let mockBuildGitLabCloneUrl: jest.MockedFunction<typeof BuildGitLabCloneUrl>;
@@ -85,14 +89,15 @@ let mockResolveModelForGitHubRepository: jest.MockedFunction<
 describe('spawnCloudAgentSession delegation', () => {
   beforeAll(async () => {
     const client = await import('@/lib/cloud-agent-next/cloud-agent-client');
-    const github = await import('@/lib/cloud-agent/github-integration-helpers');
+    const githubRepositoryContext = await import('@/lib/slack-bot/github-repository-context');
     const gitlab = await import('@/lib/cloud-agent/gitlab-integration-helpers');
     const repositorySettings = await import('@/lib/integrations/github-repository-settings');
     const spawn = await import('./spawn-cloud-agent-session');
 
     mockCreateCloudAgentNextClient = jest.mocked(client.createCloudAgentNextClient);
-    mockGetGitHubTokenForOrganization = jest.mocked(github.getGitHubTokenForOrganization);
-    mockGetGitHubTokenForUser = jest.mocked(github.getGitHubTokenForUser);
+    mockResolveGitHubRepositoryForOwner = jest.mocked(
+      githubRepositoryContext.resolveGitHubRepositoryForOwner
+    );
     mockGetGitLabTokenForUser = jest.mocked(gitlab.getGitLabTokenForUser);
     mockGetGitLabInstanceUrlForUser = jest.mocked(gitlab.getGitLabInstanceUrlForUser);
     mockBuildGitLabCloneUrl = jest.mocked(gitlab.buildGitLabCloneUrl);
@@ -113,8 +118,19 @@ describe('spawnCloudAgentSession delegation', () => {
       kiloSessionId: 'kilo-session-1',
     });
     mockInitiateFromPreparedSession.mockResolvedValue({});
-    mockGetGitHubTokenForOrganization.mockResolvedValue('organization-github-token');
-    mockGetGitHubTokenForUser.mockResolvedValue('github-token');
+    mockResolveGitHubRepositoryForOwner.mockResolvedValue({
+      id: 1,
+      name: 'repo',
+      full_name: 'owner/repo',
+      private: true,
+      githubIntegrationId: 'github-association-1',
+      githubAppType: 'standard',
+    });
+    mockGetGitHubIntegrationById.mockResolvedValue({
+      ...userIntegration,
+      id: 'github-association-1',
+      repositories: [{ id: 1, name: 'repo', full_name: 'owner/repo', private: true }],
+    });
     mockGetGitLabTokenForUser.mockResolvedValue('gitlab-token');
     mockGetGitLabInstanceUrlForUser.mockResolvedValue('https://gitlab.com');
     mockBuildGitLabCloneUrl.mockReturnValue('https://gitlab.com/group/repo.git');
@@ -138,7 +154,7 @@ describe('spawnCloudAgentSession delegation', () => {
     expect(prepareInput).toEqual(
       expect.objectContaining({
         githubRepo: 'owner/repo',
-        githubToken: 'organization-github-token',
+        githubIntegrationId: 'github-association-1',
         kilocodeOrganizationId: 'organization-1',
         createdOnPlatform: 'slack',
         attachments,
@@ -149,12 +165,17 @@ describe('spawnCloudAgentSession delegation', () => {
       })
     );
     expect(prepareInput).not.toHaveProperty('images');
+    expect(prepareInput).not.toHaveProperty('githubToken');
     for (const field of profileDerivedInlineFields) {
       expect(prepareInput).not.toHaveProperty(field);
     }
     expect(mockCreateCloudAgentNextClient).toHaveBeenCalledWith('auth-token', {
       skipBalanceCheck: true,
     });
+    expect(mockGetGitHubIntegrationById).toHaveBeenCalledWith(
+      { type: 'org', id: 'organization-1' },
+      'github-association-1'
+    );
     expect(mockInitiateFromPreparedSession).toHaveBeenCalledWith({
       cloudAgentSessionId: 'cloud-session-1',
     });
@@ -164,6 +185,40 @@ describe('spawnCloudAgentSession delegation', () => {
     });
   });
 
+  it('rejects GitHub repositories outside the owner inventory', async () => {
+    mockResolveGitHubRepositoryForOwner.mockResolvedValue(null);
+
+    await expect(
+      spawnCloudAgentSession(
+        { githubRepo: 'other/repo', prompt: 'Use the files', mode: 'code' },
+        'model',
+        organizationIntegration,
+        'auth-token',
+        'request-unknown'
+      )
+    ).resolves.toEqual(
+      expect.objectContaining({ response: expect.stringContaining('not uniquely available') })
+    );
+    expect(mockPrepareSession).not.toHaveBeenCalled();
+  });
+
+  it('rejects a repository when its selected association is foreign to the owner', async () => {
+    mockGetGitHubIntegrationById.mockResolvedValue(null);
+
+    await expect(
+      spawnCloudAgentSession(
+        { githubRepo: 'owner/repo', prompt: 'Inspect it', mode: 'code' },
+        'model',
+        organizationIntegration,
+        'auth-token',
+        'request-foreign'
+      )
+    ).resolves.toEqual(
+      expect.objectContaining({ response: expect.stringContaining('no longer available') })
+    );
+    expect(mockPrepareSession).not.toHaveBeenCalled();
+  });
+
   it('delegates GitLab profile resolution while preserving canonical repository context', async () => {
     await spawnCloudAgentSession(
       { gitlabProject: 'group/repo', prompt: 'Use the files', mode: 'ask' },
@@ -208,6 +263,10 @@ describe('spawnCloudAgentSession delegation', () => {
       expect(mockPrepareSession).toHaveBeenCalledWith(
         expect.objectContaining({ createdOnPlatform: origin })
       );
+      expect(mockGetGitHubIntegrationById).toHaveBeenCalledWith(
+        { type: 'user', id: 'owner-1' },
+        'github-association-1'
+      );
     }
   );
 
@@ -224,7 +283,10 @@ describe('spawnCloudAgentSession delegation', () => {
       { chatPlatform: 'slack' }
     );
 
-    expect(mockResolveModelForGitHubRepository).toHaveBeenCalledWith(userIntegration, 'owner/repo');
+    expect(mockResolveModelForGitHubRepository).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'github-association-1' }),
+      'owner/repo'
+    );
     expect(mockPrepareSession).toHaveBeenCalledWith(
       expect.objectContaining({ model: 'repo-override-model' })
     );

apps/web/src/lib/bot/tools/spawn-cloud-agent-session.ts

@@ -4,10 +4,6 @@ import {
   type PrepareSessionInput,
 } from '@/lib/cloud-agent-next/cloud-agent-client';
 import type { RunSessionInput } from '@/lib/cloud-agent-next/run-session';
-import {
-  getGitHubTokenForOrganization,
-  getGitHubTokenForUser,
-} from '@/lib/cloud-agent/github-integration-helpers';
 import {
   getGitLabTokenForOrganization,
   getGitLabTokenForUser,
@@ -27,6 +23,8 @@ import { captureException } from '@sentry/nextjs';
 import type { PlatformIntegration } from '@kilocode/db';
 import z from 'zod';
 import { getBotUserId } from '@/lib/bot-users/bot-user-service';
+import { resolveGitHubRepositoryForOwner } from '@/lib/slack-bot/github-repository-context';
+import { getGitHubIntegrationById } from '@/lib/integrations/db/platform-integrations';
 
 /**
  * Derive a per-request callback token so the dedicated callback HMAC secret
@@ -184,52 +182,47 @@ export default async function spawnCloudAgentSession(
       attachments: options?.attachments,
     };
   } else {
-    // GitHub path: get token, use githubRepo/githubToken
     if (!args.githubRepo) {
       // Unreachable given the guard above (one of githubRepo/gitlabProject
       // is always set here), but keeps the repo-model lookup below type-safe.
       return { response: 'Error: You must specify either a githubRepo or a gitlabProject.' };
     }
 
-    // The token fetch and the per-repository model override lookup are
-    // independent of each other, so resolve them concurrently rather than
-    // paying for two sequential round trips.
-    const [githubToken, effectiveModel] = await Promise.all([
-      owner.type === 'org'
-        ? getGitHubTokenForOrganization(owner.id)
-        : getGitHubTokenForUser(owner.id),
-      // A per-repository model override (`repository_customizations`) takes
-      // precedence over the installation-default `model` resolved earlier for
-      // this whole bot conversation — the repo is only known now that the LLM
-      // has picked one via this tool call. Guard this lookup independently so
-      // a customization-query failure falls back to the incoming `model`
-      // instead of aborting session creation entirely.
-      resolveModelForGitHubRepository(platformIntegration, args.githubRepo).catch(error => {
-        console.error(
-          '[KiloBot] Failed to resolve per-repository model override, falling back to installation model:',
-          error
-        );
-        captureException(error, {
-          tags: { component: 'kilo-bot', op: 'resolve-model-for-github-repository' },
-          extra: { botRequestId, githubRepo: args.githubRepo },
-        });
-        return model;
-      }),
-    ]);
-
-    if (!githubToken) {
+    const repository = await resolveGitHubRepositoryForOwner(owner, args.githubRepo);
+    if (!repository) {
       return {
         response:
-          'Error: No GitHub token available. Please ensure a GitHub integration is connected in your Kilo Code settings.',
+          "Error: That GitHub repository is not uniquely available through this organization's approved GitHub connections.",
+      };
+    }
+
+    const githubIntegration = await getGitHubIntegrationById(owner, repository.githubIntegrationId);
+    if (!githubIntegration) {
+      return {
+        response: 'Error: That GitHub connection is no longer available to this Kilo organization.',
       };
     }
+    const effectiveModel = await resolveModelForGitHubRepository(
+      githubIntegration,
+      args.githubRepo
+    ).catch(error => {
+      console.error(
+        '[KiloBot] Failed to resolve per-repository model override, falling back to installation model:',
+        error
+      );
+      captureException(error, {
+        tags: { component: 'kilo-bot', op: 'resolve-model-for-github-repository' },
+        extra: { botRequestId, githubRepo: args.githubRepo },
+      });
+      return model;
+    });
 
     prepareInput = {
       githubRepo: args.githubRepo,
       prompt,
       mode,
       model: effectiveModel,
-      githubToken,
+      githubIntegrationId: repository.githubIntegrationId,
       kilocodeOrganizationId,
       createdOnPlatform: chatPlatform,
       callbackTarget,

apps/web/src/lib/integrations/core/schemas.ts

@@ -2,8 +2,30 @@
  * Zod schemas for runtime validation of integration metadata
  */
 import * as z from 'zod';
+import type { PlatformRepository } from '@kilocode/db/schema-types';
 import { PENDING_APPROVAL_STATUS } from './constants';
 
+/**
+ * Persisted GitHub/GitLab repository inventory cached on platform integration rows.
+ * Unknown keys are stripped so forward-compatible cache fields do not invalidate the row.
+ */
+export const PlatformRepositoryCacheSchema = z
+  .array(
+    z.object({
+      id: z.number().int(),
+      name: z.string(),
+      full_name: z.string(),
+      private: z.boolean(),
+      default_branch: z.string().optional(),
+    })
+  )
+  .nullable();
+
+export function parsePlatformRepositoryCache(value: unknown): PlatformRepository[] {
+  const parsed = PlatformRepositoryCacheSchema.safeParse(value ?? null);
+  return parsed.success ? (parsed.data ?? []) : [];
+}
+
 /**
  * GitHub requester schema
  */