feat(cloud-agent-next): configure production preview domain and org rollout

[eshurakov]

Summary

• Add the cloud-agent.kiloapps.ai custom domain and .cloud-agent.kiloapps.ai/ route while preserving cloud-agent-next.kilosessions.ai.
• Set PREVIEW_HOST_SUFFIX to cloud-agent.kiloapps.ai.
• Enable previews for organization 9d278969-5453-4ae3-a51f-a8d2274a7b56 while preserving the existing allowlist entry.
• Regenerate Worker bindings and update the environment catalog.
• Delete src/callbacks/queue-config.test.ts, which only asserted Wrangler configuration values, as requested.

Verification

• Focused preview behavior suites: 3 files, 83 tests passed after deleting configuration tests.
• Worker TypeScript check: pnpm exec tsgo --noEmit passed for the configuration changes.
• Formatting and git diff --check passed.

Rollout

• No deployment performed. These settings take effect on the next production Worker deployment.
• Production wildcard DNS and TLS were not verified; TLS must cover *.cloud-agent.kiloapps.ai.

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

This revision re-scopes the PR to the production preview-domain rollout: the production PREVIEW_HOST_SUFFIX still turns preview host dispatch on for all users ahead of the documented Public Suffix List / browser-entry and kilo serve password prerequisites, and deleting queue-config.test.ts removes the only guard pairing the callback queue max_retries with CALLBACK_DELIVERY_MAX_ATTEMPTS.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/wrangler.jsonc	79	Setting PREVIEW_HOST_SUFFIX in production enables preview host dispatch for all users before the documented Public Suffix List / browser-entry and kilo serve password prerequisites are confirmed (active inline comment)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/callbacks/queue-config.test.ts	—	Deletion removes the only test asserting each callback queue consumer max_retries matches CALLBACK_DELIVERY_MAX_ATTEMPTS (deletion-only; summary-only)

Files Reviewed (4 files)

• ENVIRONMENT.md - no issues
• services/cloud-agent-next/wrangler.jsonc - 1 issue (carried forward)
• services/cloud-agent-next/worker-configuration.d.ts - generated, no issues
• services/cloud-agent-next/src/callbacks/queue-config.test.ts - 1 suggestion (carried forward, deletion-only)

Fix these issues in Kilo Cloud

Previous Review Summaries (3 snapshots, latest commit e9ef436)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit e9ef436)

Status: 3 Issues Found | Recommendation: Address before merge

Executive Summary

The new Cloud Agent PR-watching migration is committed without its generated Drizzle snapshot, and the production preview-suffix enablement still lacks the documented Public Suffix List / browser-entry and kilo serve password prerequisites.

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/db/src/migrations/0279_busy_magik.sql	1	Migration and _journal.json entry committed without the generated meta/0279_snapshot.json; breaks the schema.test.ts consistency guard and would make the next pnpm drizzle generate re-emit this DDL
services/cloud-agent-next/wrangler.jsonc	79	Production PREVIEW_HOST_SUFFIX set ahead of the documented Public Suffix List / browser-entry and kilo serve password prerequisites (previously reported)

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/callbacks/queue-config.test.ts	—	Deletion removes the only guard pairing CALLBACK_DELIVERY_MAX_ATTEMPTS with the queue consumer max_retries (previously reported, deletion-only)

Files Reviewed (18 files)

• apps/web/src/lib/cloud-agent/watch-pr.ts - no issues
• apps/web/src/lib/cloud-agent/watch-pr-events.ts - no issues
• apps/web/src/lib/cloud-agent/watch-pr-webhook.ts - no issues
• apps/web/src/lib/cloud-agent/watch-pr.test.ts - no issues
• apps/web/src/lib/cloud-agent/watch-pr-events.test.ts - no issues
• apps/web/src/lib/cloud-agent/watch-pr-webhook.test.ts - no issues
• apps/web/src/lib/integrations/platforms/github/webhook-handler.ts - no issues
• apps/web/src/lib/integrations/platforms/github/webhook-handler.test.ts - no issues
• apps/web/src/lib/user/index.ts - no issues
• apps/web/src/lib/user/index.test.ts - no issues
• apps/web/src/routers/cli-sessions-v2-router.ts - no issues
• packages/db/src/schema.ts - no issues
• packages/db/src/schema-types.ts - no issues
• packages/db/src/migrations/0279_busy_magik.sql - 1 issue
• packages/db/src/migrations/meta/_journal.json - context only
• services/kilo-mcp/catalog.json - no issues
• .kilo/skills/kilo-mcp/SKILL.md - no issues
• services/cloud-agent-next/wrangler.jsonc - 1 issue (carried forward)
• services/cloud-agent-next/src/callbacks/queue-config.test.ts - 1 suggestion (carried forward, deletion-only)

Fix these issues in Kilo Cloud

Previous review (commit dee0fdf)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

Setting PREVIEW_HOST_SUFFIX in production enables preview host dispatch for all users without the documented Public Suffix List/browser-entry and kilo serve password prerequisites, and this revision also deletes the only test that guarded the callback queue retry-budget pairing.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/wrangler.jsonc	79	Production preview enablement without the documented PSL/browser-entry and kilo serve password prerequisites

SUGGESTION

File	Line	Issue
services/cloud-agent-next/src/callbacks/queue-config.test.ts	—	Deleting the file removes the only guard for the CALLBACK_DELIVERY_MAX_ATTEMPTS to queue consumer max_retries pairing

Files Reviewed (3 files)

• services/cloud-agent-next/src/callbacks/queue-config.test.ts - 1 suggestion (deletion-only, no inline target)
• services/cloud-agent-next/wrangler.jsonc - 1 warning (re-verified, already inline)
• services/cloud-agent-next/docs/control-plane.md - context for the warning

Fix these issues in Kilo Cloud

Previous review (commit 8c8d7f5)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Setting PREVIEW_HOST_SUFFIX in production enables preview host dispatch for all users while the documented Public Suffix List/browser-entry and kilo serve password-image prerequisites are unverified.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/cloud-agent-next/wrangler.jsonc	79	Production preview enablement without the documented PSL/browser-entry and kilo serve password prerequisites

Files Reviewed (4 files)

• services/cloud-agent-next/wrangler.jsonc - 1 issue
• ENVIRONMENT.md - no issues
• services/cloud-agent-next/src/callbacks/queue-config.test.ts - no issues
• services/cloud-agent-next/worker-configuration.d.ts - no issues (generated)

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 60.7K · Output: 15.6K · Cached: 597.2K}

_{Review guidance: REVIEW.md from base branch main}