feat(bitbucket): add Code Reviewer support by eshurakov · Pull Request #4291 · Kilo-Org/cloud

eshurakov · 2026-06-28T19:16:01Z

Summary

Adds Bitbucket Code Reviewer support across web, worker, git-token-service, code-review infra, and wrapper CLI.
Installs workspace webhooks using supported Bitbucket pull request events, verifies signed delivery, queues reviews, and publishes inline Code Review Findings through batch comments.
Cleans up Bitbucket Code Reviewer state, queued/running reviews, and workspace webhooks when Code Reviewer is disabled or a Workspace Access Token is disconnected.

Verification

N/A

Visual Changes

N/A

Reviewer Notes

Review focus: Bitbucket webhook lifecycle, command guard allowlist, and integration disconnect cleanup.

kilo-code-bot · 2026-06-28T19:21:30Z

+DROP INDEX "UQ_cloud_agent_code_reviews_repo_pr_sha";--> statement-breakpoint
+ALTER TABLE "cloud_agent_code_reviews" ADD COLUMN "platform_repository_id" text;--> statement-breakpoint
+ALTER TABLE "cloud_agent_code_reviews" ADD COLUMN "platform_workspace_id" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "UQ_cloud_agent_code_reviews_user_identity" ON "cloud_agent_code_reviews" USING btree ("owned_by_user_id","platform","platform_integration_id","platform_repository_id","pr_number","head_sha") WHERE "cloud_agent_code_reviews"."owned_by_user_id" is not null;--> statement-breakpoint


WARNING: New uniqueness is inactive until the backfill runs

platform_repository_id is still NULL for every existing row when these indexes are created, and Postgres unique indexes treat NULL values as distinct. Because line 1 drops the old repo/PR/head uniqueness first, a rolling deploy can insert duplicate reviews until the UPDATE at lines 7-13 populates this column. Populate/backfill the new identity before replacing the old uniqueness constraint.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-06-28T19:21:30Z

-      "store_id": "342a86d9e3a94da698e82d0c6e2a36f0",
-      "secret_name": "BITBUCKET_OAUTH_CREDENTIAL_ACTIVE_KEY_ID_PROD",
-    },
  ],


WARNING: BITBUCKET_OAUTH_CREDENTIAL_ACTIVE_KEY_ID is still required at runtime

BitbucketWorkspaceAccessTokenAuthorizationService.decrypt() still reads env.BITBUCKET_OAUTH_CREDENTIAL_ACTIVE_KEY_ID to unwrap stored workspace tokens. Removing the binding here, and again under env.dev, leaves that env unset in deployed workers, so Bitbucket code-review lookups will fall back to secret_missing / temporarily_unavailable. Keep the binding or add an equivalent vars entry before shipping this config change.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-06-28T19:21:40Z

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`services/cloud-agent-next/src/types.ts`	52	`parseCanonicalBitbucketCloneUrl()` now accepts `ssh://` URLs, which broadens Bitbucket code-review admission past the repo's canonical HTTPS clone-url contract.

Fix these issues in Kilo Cloud

Files Reviewed (3 files)

services/cloud-agent-next/src/session-service.test.ts - 0 issues
services/cloud-agent-next/src/session-service.ts - 0 issues
services/cloud-agent-next/src/types.ts - 1 issue

Previous Review Summaries (4 snapshots, latest commit a01f56b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `a01f56b`)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0174_absent_rumiko_fujikawa.sql`	13	The new unique indexes are still created without `CONCURRENTLY`, so this migration can block writes on the populated `cloud_agent_code_reviews` table during deploy.
`services/cloud-agent-next/src/session-service.ts`	1107	The SSH fallback only covers scp-style `git@host:path` clone URLs; valid `ssh://git@...` GitLab and Bitbucket URLs still return `undefined`, so those legacy sessions keep missing the provider env vars they rely on.

Fix these issues in Kilo Cloud

Files Reviewed (3 files)

packages/db/src/migrations/0174_absent_rumiko_fujikawa.sql - 1 issue
services/cloud-agent-next/src/session-service.ts - 1 issue
services/cloud-agent-next/src/session-service.test.ts - 0 issues

Previous review (commit `a3e5861`)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0174_absent_rumiko_fujikawa.sql`	13	The new unique indexes are still created without `CONCURRENTLY`, so this migration can block writes on the populated `cloud_agent_code_reviews` table during deploy.
`services/cloud-agent-next/src/session-service.ts`	1107	Restricting fallback inference to `https:` URLs drops legacy SSH GitLab and Bitbucket clone URLs, so platform-less sessions stop receiving the provider env vars they still rely on.

Fix these issues in Kilo Cloud

Files Reviewed (4 files)

packages/db/src/migrations/0174_absent_rumiko_fujikawa.sql - 1 issue
services/cloud-agent-next/src/session-service.ts - 1 issue
services/cloud-agent-next/src/session-service.test.ts - 0 issues
services/git-token-service/wrangler.jsonc - 0 issues

Previous review (commit `f642092`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

apps/web/src/lib/cloud-agent/bitbucket-integration-helpers.ts

Previous review (commit `15e3d51`)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0174_absent_rumiko_fujikawa.sql`	4	Replacement unique indexes are created before `platform_repository_id` is backfilled, so duplicate reviews can slip through while the new key column is still `NULL`.
`services/git-token-service/wrangler.jsonc`	61	The `BITBUCKET_OAUTH_CREDENTIAL_ACTIVE_KEY_ID` binding was removed even though runtime decryption still requires it, which leaves Bitbucket review lookups unavailable after deploy.

Fix these issues in Kilo Cloud

Files Reviewed (123 files)

packages/db/src/migrations/0174_absent_rumiko_fujikawa.sql - 1 issue
services/git-token-service/wrangler.jsonc - 1 issue
Remaining 121 changed files reviewed with no additional high-confidence findings

_{Reviewed by gpt-5.4-20260305 · Input: 125.3K · Output: 9.9K · Cached: 793.3K}

_{Review guidance: REVIEW.md from base branch main}

kilo-code-bot · 2026-06-28T19:50:57Z

+WHERE "platform_repository_id" IS NULL;
+--> statement-breakpoint
+DROP INDEX "UQ_cloud_agent_code_reviews_repo_pr_sha";--> statement-breakpoint
+CREATE UNIQUE INDEX "UQ_cloud_agent_code_reviews_user_identity" ON "cloud_agent_code_reviews" USING btree ("owned_by_user_id","platform","platform_integration_id","platform_repository_id","pr_number","head_sha") WHERE "cloud_agent_code_reviews"."owned_by_user_id" is not null;--> statement-breakpoint


WARNING: These unique indexes still lock a populated table during deploy

The UPDATE immediately above backfills existing rows, so cloud_agent_code_reviews is already populated when these indexes are built. Creating them without CONCURRENTLY will block concurrent writes for the duration of the index build, which is the table-locking migration pattern we try to avoid on live tables.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-06-28T19:50:57Z

+    return undefined;
+  }
+
+  if (url.protocol !== 'https:') return undefined;


WARNING: SSH clone URLs stop getting legacy GitLab or Bitbucket env setup

parseSessionMetadata() still accepts legacy gitUrl strings verbatim, including SSH forms like git@gitlab.com:group/repo.git. With the new https: gate here, platform-less legacy sessions now fall back to effectivePlatform === undefined, so the GitLab or Bitbucket env vars stop being injected even though the old substring fallback handled those stored clone URLs.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-06-28T20:24:21Z

+  if (url.hostname !== 'bitbucket.org' || url.port || url.search || url.hash) return null;
+  if (url.protocol === 'https:') {
+    if (url.username || url.password) return null;
+  } else if (url.protocol === 'ssh:') {


WARNING: parseCanonicalBitbucketCloneUrl() no longer enforces the canonical HTTPS clone-URL contract

This helper also backs Bitbucket code-review admission in router/schemas.ts, so accepting ssh://git@bitbucket.org/... here now lets new review sessions through with non-canonical clone URLs. The rest of the repo still treats SSH Bitbucket clone URLs as invalid canonical identities, so this creates a mismatch between session admission and downstream URL validation.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

feat(bitbucket): add Code Reviewer support

15e3d51

github-advanced-security AI found potential problems Jun 28, 2026

View reviewed changes

Comment thread services/cloud-agent-next/src/session-service.ts Fixed

kilo-code-bot Bot reviewed Jun 28, 2026

View reviewed changes

eshurakov added 2 commits June 28, 2026 21:32

fix(bitbucket): keep workspace token repo listing cached

f642092

fix(bitbucket): address PR review warnings

a3e5861

kilo-code-bot Bot reviewed Jun 28, 2026

View reviewed changes

eshurakov added 2 commits June 28, 2026 21:58

fix(bitbucket): preserve legacy platform inference

a01f56b

fix(bitbucket): support ssh clone URL inference

b944a7b

kilo-code-bot Bot reviewed Jun 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(bitbucket): add Code Reviewer support#4291

feat(bitbucket): add Code Reviewer support#4291
eshurakov wants to merge 5 commits into
mainfrom
faceted-plank

eshurakov commented Jun 28, 2026

Uh oh!

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Uh oh!

kilo-code-bot Bot commented Jun 28, 2026 •

edited

Loading

WARNING

Previous review (commit `a01f56b`)

Overview

WARNING

Previous review (commit `a3e5861`)

Overview

WARNING

Previous review (commit `f642092`)

Previous review (commit `15e3d51`)

Overview

WARNING

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

eshurakov commented Jun 28, 2026

Summary

Verification

Visual Changes

Reviewer Notes

Uh oh!

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

WARNING

Previous review (commit a01f56b)

Overview

WARNING

Previous review (commit a3e5861)

Overview

WARNING

Previous review (commit f642092)

Previous review (commit 15e3d51)

Overview

WARNING

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Jun 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kilo-code-bot Bot commented Jun 28, 2026 •

edited

Loading

Previous review (commit `a01f56b`)

Previous review (commit `a3e5861`)

Previous review (commit `f642092`)

Previous review (commit `15e3d51`)