Skip to content

feat(bot): add PR signature to Cloud Agent prompts in bot SDK#1914

Merged
RSO merged 3 commits intomainfrom
feat/bot-pr-signature
Apr 2, 2026
Merged

feat(bot): add PR signature to Cloud Agent prompts in bot SDK#1914
RSO merged 3 commits intomainfrom
feat/bot-pr-signature

Conversation

@kilo-code-bot
Copy link
Copy Markdown
Contributor

@kilo-code-bot kilo-code-bot bot commented Apr 2, 2026

Summary

Ports the PR signature feature from the old src/lib/slack-bot.ts and src/lib/discord-bot.ts implementations into the new bot SDK (src/lib/bot/). When the Cloud Agent creates a PR or MR via the bot, the description now includes a "Built for User by Kilo for Platform" attribution line at the end, matching the behavior of the legacy bot implementations.

Changes:

  • New src/lib/bot/pr-signature.ts — Platform-aware buildPrSignature() and getRequesterInfo() functions. For Slack, fetches a message permalink via the Slack API; for Discord, constructs the link from guild/channel/message IDs; for other platforms, degrades gracefully (name only, no link).
  • Updated src/lib/bot/agent-runner.ts — Imports PR signature functions, gathers requester info when a full Message is available (via rawMessage), derives chatPlatform from the thread ID, and passes both as options to spawnCloudAgentSession.
  • Updated src/lib/bot/run.ts — Passes rawMessage to runBotAgent so the full Message (with raw for platform-specific fields) is available for PR signature building.
  • Updated src/lib/bot/tools/spawn-cloud-agent-session.ts — Accepts an optional options parameter with prSignature and chatPlatform. Appends the signature to the Cloud Agent prompt when present. Uses dynamic chatPlatform instead of hardcoded 'slack' for createdOnPlatform. Retains botRequestId and callbackTarget from the main branch refactor.

Verification

  • oxfmt --list-different . — passes (no formatting issues)
  • Pre-push hooks (format, lint, typecheck) — all pass
  • No merge conflict markers remain in any files
  • Manually reviewed all changes against both the original PR intent and current main architecture

Visual Changes

N/A

Reviewer Notes

  • Merge conflicts with main have been resolved directly on this branch. The original PR's run.ts changes were adapted to main's refactored architecture where tool setup lives in agent-runner.ts rather than run.ts.
  • The rawMessage field on RunBotAgentParams is optional so the callback route (which creates synthetic BotAgentMessageLike messages without raw) continues to work — PR signature is simply skipped when rawMessage is not provided.
  • The chatPlatform defaults to 'slack' in spawnCloudAgentSession to maintain backward compatibility if called without options.
  • Closes feat(bot): add PR signature to Cloud Agent prompts in bot SDK #1922 which was a duplicate PR created to resolve these conflicts.

Port the PR signature feature from the old slack-bot/discord-bot
implementations into the new bot SDK. When the Cloud Agent creates a
PR/MR, the description now includes a 'Built for [User](link) by
[Kilo for Platform]' attribution line.
*/
export function buildPrSignature(requesterInfo: RequesterInfo): string {
const requesterPart = requesterInfo.messageLink
? `[${requesterInfo.displayName}](${requesterInfo.messageLink})`
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Escape requester names before interpolating them into markdown

displayName comes from Slack/Discord user profiles and is user-controlled. Names containing markdown metacharacters like ], (, or ) will break the generated Built for [...]() link, and can also inject unintended markdown/instructions into the prompt sent to Cloud Agent. Escape the name before building the link, or render the linked case without reusing raw markdown syntax.

@kilo-code-bot
Copy link
Copy Markdown
Contributor Author

kilo-code-bot bot commented Apr 2, 2026

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 1
SUGGESTION 0
Issue Details (click to expand)

WARNING

File Line Issue
src/lib/bot/pr-signature.ts 28 User-controlled display names are interpolated into markdown without escaping, which can break the PR signature link and inject unintended markdown into the Cloud Agent prompt.

Fix these issues in Kilo Cloud

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File Line Issue
N/A N/A None.
Files Reviewed (4 files)
  • src/lib/bot/agent-runner.ts - 0 issues
  • src/lib/bot/pr-signature.ts - 1 issue
  • src/lib/bot/run.ts - 0 issues
  • src/lib/bot/tools/spawn-cloud-agent-session.ts - 0 issues

Reviewed by gpt-5.4-20260305 · 760,813 tokens

kilo-code-bot bot added 2 commits April 2, 2026 14:04
Merge main into feat/bot-pr-signature, resolving conflicts in:
- run.ts: Accept refactored main version (thin wrapper) and add rawMessage for PR signature
- spawn-cloud-agent-session.ts: Merge botRequestId + callbackTarget from main with prSignature/chatPlatform options, use dynamic chatPlatform
- agent-runner.ts: Add PR signature imports, rawMessage param, signature building logic, and pass options to spawnCloudAgentSession
@RSO RSO merged commit 19c2987 into main Apr 2, 2026
15 checks passed
@RSO RSO deleted the feat/bot-pr-signature branch April 2, 2026 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants