feat(git-token): authorize exact provider review resources

[iscekic]

• For GitLab sessions outside code reviews, Kilo uses the matching repository connection and stops when more than one connection matches.
• GitLab code reviews stop if access checks fail for any matching connection, even when another connection works.

---

Summary

BitbucketInteractiveHttpRequestSchema binds review operations to authorized organization resources and rechecks credential identity to prevent account or repository substitution.
The broker returns credential-free provider identity metadata and requires pullrequest:write for approval, change-request, withdrawal, and merge operations.
Merges default close_source_branch to false and reject deletion across forks; rejected workspace tokens invalidate only the selected credential.

Files

• services/git-token-service/src/interactive-review-handler.ts — source, added (306 lines); adds the request schema and authorization query for unblocked organization members or administrators. Requires an active organization-owned integration, a valid repository sync timestamp, matching workspace and repository identities, and existing grants. Rechecks OAuth credential and actor identities or workspace credential identity and version after token resolution; identity changes require reconnection. Validates strict metadata containing the Kilo actor, organization, integration, provider principal, and scopes, without a provider token. Addresses requests by immutable workspace and repository identifiers, checks merge deletion against the source repository, and returns safe failure reasons. The source check provides no atomic head guard.
• services/git-token-service/src/interactive-review-handler.test.ts — test, added (462 lines); adds the interactive review handler suite.

POST /internal/bitbucket/interactive-review requires an organization claim and BITBUCKET_INTERACTIVE_AUDIENCE (git-token-service:bitbucket-interactive-review), isolating it from other internal token audiences.
Requests use the 256,000-byte BITBUCKET_INTERACTIVE_REQUEST_MAX_BYTES limit, return 413 for oversized bodies, and apply Cache-Control: no-store to successes and errors.
Existing endpoints retain their 16,000-byte limit and audiences, including unchanged GitHub behavior.

Files

• services/git-token-service/src/index.ts — source, modified (80 changed lines); registers the route and derives the user and organization from verified claims. Adds an optional limit and a distinct oversized-body error to the shared JavaScript Object Notation (JSON) reader. Validates JSON bodies before dispatch, returns 400 for invalid input and 413 for excessive size, and keeps existing endpoint errors unchanged. Applies the new audience and no-store headers throughout the route, rejects missing organizations, and converts unexpected failures to temporarily_unavailable.
• packages/worker-utils/src/internal-service-token-audiences.ts — source, modified (1 changed line); exports the dedicated Bitbucket interactive audience without changing existing audiences.
• services/git-token-service/src/index.test.ts — test, modified (300 changed lines); updates the service route suite.
• packages/worker-utils/src/internal-service-token-audiences.test.ts — test, modified (26 changed lines); updates the internal service audience suite.

GetGitLabTokenParams.expectedIntegrationId also reaches IssueGitLabSessionCapabilityParams, letting token and capability requests select an exact authorized integration.
Unpinned requests retain authorized lookup and legacy instance subpaths; ordinary sessions now reject ambiguous matches, mismatched credentials, and mismatched instances.
Review sessions still require a valid repository, and any candidate credential failure now blocks success even when another candidate qualifies.

Files

• services/git-token-service/src/gitlab-runtime-token-resolver.ts — source, modified (65 changed lines); adds the optional pin and filters authorized integrations by the repository before credential resolution. Validates review repository input before lookup and checks returned credential identity and normalized instance identity. Preserves authorized legacy prefixes despite the generic URL check. Retains unpinned requests for old callers and records, including the documented 30-day ledger window, without adding an automatic cutoff. Returns ambiguous_integration or no_matching_integration instead of selecting another connection, and prioritizes candidate credential failures over a usable review credential.
• services/git-token-service/src/gitlab-runtime-token-resolver.test.ts — test, modified (333 changed lines); updates the GitLab runtime token suite.

Tests: 4 files changed (1 added, 3 modified; 1,121 changed lines): interactive-review-handler.test.ts, index.test.ts, internal-service-token-audiences.test.ts, and gitlab-runtime-token-resolver.test.ts.
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

• No live provider verification has run for this implementation.
• Manual runtime verification is pending for the cumulative stack.

Reviewer Notes

• Scope: level 4 only, mobile-provider-parity-1d93-s3...mobile-provider-parity-1d93-s4.
• Repository: Kilo-Org/cloud; worktree: /Users/igor/Projects/.worktrees/mobile-provider-parity-1d93.
• The handoff reports 230 passing focused tests and a clean bounded recheck.

Human steps

• before merge: None.
• after merge: None.

Notes

Runtime verification is pending for the cumulative stack; this level adds no visual surface.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. mobile-provider-parity-1d93-s1 — feat(provider-review): add shared identity and stack checks #5663
2. mobile-provider-parity-1d93-s2 — feat(provider-review): define review contracts and vocabulary #5665
3. mobile-provider-parity-1d93-s3 — feat(provider-review): add safe provider SDK boundaries #5689
4. mobile-provider-parity-1d93-s4 — feat(git-token): authorize exact provider review resources #5692 ← this PR
5. mobile-provider-parity-1d93-s5 — feat(cloud-agent): preserve provider identity through checkout #5700
6. mobile-provider-parity-1d93-s6 — feat(provider-review): expose exact repositories and branches #5705
7. mobile-provider-parity-1d93-s7 — feat(mobile): preserve provider launch and recent identity #5711
8. mobile-provider-parity-1d93-s8 — feat(mobile): select exact provider repositories and branches #5729
9. mobile-provider-parity-1d93-s9 — feat(provider-review): add authorized GitLab review reads #5738
10. mobile-provider-parity-1d93-s10 — feat(provider-review): add authorized Bitbucket review reads #5745
11. mobile-provider-parity-1d93-s11 — feat(provider-review): add reconciled GitLab review actions #5748
12. mobile-provider-parity-1d93-s12 — feat(provider-review): add Bitbucket review actions and recovery #5756
13. mobile-provider-parity-1d93-s13 — feat(provider-review): expose the neutral review facade #5763 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• services/git-token-service/src/bitbucket-interactive-api.ts
• services/git-token-service/src/bitbucket-interactive-api.test.ts
• services/git-token-service/src/interactive-review-handler.ts
• services/git-token-service/src/interactive-review-handler.test.ts

Previous Review Summaries (3 snapshots, latest commit e277180)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit e277180)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (13 files)

• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.ts
• apps/web/src/lib/integrations/platforms/bitbucket/interactive-client.test.ts
• services/git-token-service/src/bitbucket-interactive-api.ts
• services/git-token-service/src/bitbucket-interactive-api.test.ts
• services/git-token-service/src/github-session-capability.ts
• services/git-token-service/src/github-session-capability.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/installation-lookup-service.ts
• services/git-token-service/src/installation-lookup-service.test.ts
• services/git-token-service/src/installation-lookup-service.behavior.test.ts
• services/git-token-service/src/interactive-review-handler.ts
• services/git-token-service/src/interactive-review-handler.test.ts

Previous review (commit 28e1ecf)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• services/git-token-service/src/bitbucket-runtime-token-resolver.ts
• services/git-token-service/src/bitbucket-runtime-token-resolver.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/index.test.ts

Previous review (commit 32460b1)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (8 files)

• packages/worker-utils/src/internal-service-token-audiences.ts
• packages/worker-utils/src/internal-service-token-audiences.test.ts
• services/git-token-service/src/gitlab-runtime-token-resolver.ts
• services/git-token-service/src/gitlab-runtime-token-resolver.test.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/interactive-review-handler.ts
• services/git-token-service/src/interactive-review-handler.test.ts

---

_{Reviewed by grok-4.6 · Input: 66.9K · Output: 14K · Cached: 459.6K}

_{Review guidance: REVIEW.md from base branch mobile-provider-parity-1d93-s3}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.