feat(agent-harness): read scoped Cloud Agent context and progress

[iscekic]

No new behavior — this change prepares session features without making them available in the product.

---

Summary

createHarnessCloudAgentContext adds freshly authorized kilo.sessions.search, kilo.sessions.attach, and kilo.sessions.progress reads, scoped helpers, and stable messageId values without adding mutation dispatch.
Invocation and ToolRequestSchema validate requests; search and history return at most 20 items, while attached text remains untrusted and progress exposes status.
History uses bounded transport before decoding; requests and validated ToolOutcome.output values have 64 KiB limits, and existing callers remain unchanged.

Files

• apps/web/src/lib/agent-harness/cloud-agent-context.ts — added (+164 lines); normalizes invocation identifiers and binds authority and replay identity to the conversation, operation, definition version, arguments, and dispatch. It verifies ownership and returned identities across personal and organization scopes, requires cloud links for progress, and preserves empty history and typed failures. Search returns titles with session identifier fallbacks; attachments retain text only; progress returns execution status, prepared, or idle.

The Cloud Agent read tests cover personal and organization scopes, authority revocation between reads, identity checks, byte limits, and stable replay identifiers.
The shared fixture uses authorization and router doubles; two overflow regressions use the real transport to reject oversized non-text history before decoding.
The suite checks failures separately from empty results, but it does not prove live authority or service behavior.

Files

• apps/web/src/lib/agent-harness/cloud-agent-context.test.ts — added (+190 lines); covers the three reads, real session linkage, grant rechecks, transport overflow, error mapping, sanitized outputs, and replay identity.
• apps/web/src/lib/agent-harness/cloud-agent-test-fixture.ts — added (+125 lines); provides resettable personal and organization callers, authority guards, private session data, and controls for revocation, outages, and empty results.

Tests: 2 files added (+315 lines): cloud-agent-context.test.ts and cloud-agent-test-fixture.ts; all 36 focused tests passed.
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

No manual tests ran because this level does not activate the harness.

Reviewer Notes

Human steps: None before merge or after merge.

Captured format, lint, and patch checks passed. Continuous integration (CI) owns database execution and project-wide type checks.

Runtime verification remains pending at the stack tip. This level adds scoped Cloud Agent reads without activating the harness.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726 ← this PR (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the new scoped Cloud Agent search, attach, and progress reads, including ownership checks and bounded history, with high confidence and no correctness or security issues in the changed code.

Files Reviewed (3 files)

• apps/web/src/lib/agent-harness/cloud-agent-context.ts
• apps/web/src/lib/agent-harness/cloud-agent-context.test.ts
• apps/web/src/lib/agent-harness/cloud-agent-test-fixture.ts

---

_{Reviewed by grok-4.6 · Input: 269K · Output: 25.5K · Cached: 2.4M}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s20}