refactor(cloud-agent-next): make wrapper the single control plane

cloud-agent-next/Dockerfile

@@ -39,8 +39,9 @@ RUN npm install -g pnpm @kilocode/cli@${KILOCODE_CLI_VERSION}
 COPY wrapper /tmp/wrapper-build/wrapper
 COPY src/shared /tmp/wrapper-build/src/shared
 
-# Build the wrapper bundle and restore-session script
+# Install wrapper dependencies (pnpm symlinks don't survive COPY) and build
 RUN cd /tmp/wrapper-build/wrapper && \
+    bun install --production && \
     bun build src/main.ts --outfile=/usr/local/bin/kilocode-wrapper.js --target=bun --minify && \
     bun build src/restore-session.ts --outfile=/usr/local/bin/kilo-restore-session.js --target=bun --minify && \
     rm -rf /tmp/wrapper-build

cloud-agent-next/Dockerfile.dev

@@ -40,7 +40,9 @@ RUN npm install -g pnpm @kilocode/cli@${KILOCODE_CLI_VERSION}
 COPY wrapper /tmp/wrapper-build/wrapper
 COPY src/shared /tmp/wrapper-build/src/shared
 
+# Install wrapper dependencies (pnpm symlinks don't survive COPY) and build
 RUN cd /tmp/wrapper-build/wrapper && \
+    bun install --production && \
     bun build src/main.ts --outfile=/usr/local/bin/kilocode-wrapper.js --target=bun --minify && \
     bun build src/restore-session.ts --outfile=/usr/local/bin/kilo-restore-session.js --target=bun --minify && \
     rm -rf /tmp/wrapper-build

cloud-agent-next/src/execution/orchestrator.ts

@@ -19,7 +19,6 @@ import { ExecutionError } from './errors.js';
 import { SessionService, type PreparedSession } from '../session-service.js';
 import { logger } from '../logger.js';
 import { updateGitRemoteToken } from '../workspace.js';
-import { ensureKiloServer } from '../kilo/server-manager.js';
 import { WrapperClient } from '../kilo/wrapper-client.js';
 import { withDORetry } from '../utils/do-retry.js';
 import { normalizeAgentMode } from '../schema.js';
@@ -102,23 +101,26 @@ export class ExecutionOrchestrator {
       }
     }
 
-    // 4. Ensure kilo server is running (may throw KILO_SERVER_FAILED)
-    let kiloServerPort: number;
+    // 4. Ensure wrapper is running (starts kilo server in-process)
+    let wrapperClient: WrapperClient;
+    let kiloSessionId: string;
     try {
-      kiloServerPort = await ensureKiloServer(
-        sandbox,
-        prepared.session,
-        sessionId,
-        prepared.context.workspacePath
-      );
+      const result = await WrapperClient.ensureWrapper(sandbox, prepared.session, {
+        agentSessionId: sessionId,
+        userId,
+        workspacePath: prepared.context.workspacePath,
+        sessionId: wrapper.kiloSessionId,
+      });
+      wrapperClient = result.client;
+      kiloSessionId = result.sessionId;
     } catch (error) {
-      throw ExecutionError.kiloServerFailed(
-        `Failed to start kilo server: ${error instanceof Error ? error.message : String(error)}`,
+      throw ExecutionError.wrapperStartFailed(
+        `Failed to start wrapper: ${error instanceof Error ? error.message : String(error)}`,
         error
       );
     }
 
-    // Record kilo server activity for idle timeout tracking
+    // 5. Record activity for idle timeout tracking
     try {
       await withDORetry(
         () => this.deps.getSessionStub(userId, sessionId),
@@ -130,59 +132,19 @@ export class ExecutionOrchestrator {
       logger.warn('Failed to record kilo server activity');
     }
 
-    // 5. Ensure wrapper is running (may throw WRAPPER_START_FAILED)
-    let wrapperClient: WrapperClient;
-    try {
-      wrapperClient = await WrapperClient.ensureWrapper(
-        sandbox,
-        prepared.session,
-        sessionId,
-        kiloServerPort,
-        prepared.context.workspacePath,
-        {
-          autoCommit: wrapper.autoCommit,
-          condenseOnComplete: wrapper.condenseOnComplete,
-          upstreamBranch: prepared.context.upstreamBranch,
-          model: wrapper.model?.modelID,
-        }
-      );
-    } catch (error) {
-      throw ExecutionError.wrapperStartFailed(
-        `Failed to start wrapper: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-
-    // 6. Start job (create/resume kilo session)
+    // 6. Send prompt with execution binding (async - returns messageId immediately)
     const ingestUrl = this.deps.getIngestUrl(sessionId, userId);
-    // Ingest token must match executionId for /ingest auth validation
     const ingestToken = executionId;
-
-    // Get kilocode token from plan
     const kilocodeToken = this.getKilocodeToken(plan);
 
-    let kiloSessionId: string;
-    try {
-      const result = await wrapperClient.startJob({
-        executionId,
-        ingestUrl,
-        ingestToken,
-        sessionId,
-        userId,
-        kilocodeToken,
-        kiloSessionId: wrapper.kiloSessionId,
-        kiloSessionTitle: wrapper.kiloSessionTitle,
-      });
-      kiloSessionId = result.kiloSessionId;
-      logger.withFields({ kiloSessionId }).info('Wrapper job started');
-    } catch (error) {
-      throw ExecutionError.wrapperStartFailed(
-        `Failed to start wrapper job: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
+    const execution = {
+      executionId,
+      ingestUrl,
+      ingestToken,
+      workerAuthToken: kilocodeToken,
+      upstreamBranch: prepared.context.upstreamBranch,
+    };
 
-    // 7. Send prompt (async - returns messageId immediately)
     // Normalize mode to internal mode (e.g., 'architect' -> 'plan', 'orchestrator' -> 'code')
     const normalizedMode = normalizeAgentMode(mode);
     try {
@@ -191,6 +153,9 @@ export class ExecutionOrchestrator {
         model: wrapper.model,
         variant: wrapper.variant,
         agent: normalizedMode,
+        autoCommit: wrapper.autoCommit,
+        condenseOnComplete: wrapper.condenseOnComplete,
+        execution,
       });
       logger.withFields({ inflightId: result.messageId }).info('Prompt sent to wrapper');
     } catch (error) {

cloud-agent-next/src/kilo/client.test.ts

@@ -9,7 +9,7 @@ import {
   KiloTimeoutError,
 } from './errors.js';
 import type { ExecutionSession } from '../types.js';
-import type { Session, SessionCommandResponse } from './types.js';
+import type { Session } from './types.js';
 
 type KiloClientPrivates = {
   parseResponse: (stdout: string) => { responseBody: string; httpStatus: number };
@@ -219,7 +219,7 @@ describe('KiloClient', () => {
       const callSpy = vi
         .spyOn(client, 'call')
         .mockResolvedValueOnce(buildSession('ses_1'))
-        .mockResolvedValueOnce({} as unknown as SessionCommandResponse);
+        .mockResolvedValueOnce({} as unknown);
 
       await client.resumeSession('ses_1');
       await client.command('help', '', { model: 'anthropic/claude-sonnet-4-20250514' });

cloud-agent-next/src/kilo/index.ts

@@ -1,4 +1,3 @@
-export * from './server-manager.js';
 export * from './client.js';
 export * from './errors.js';
 export * from './types.js';

cloud-agent-next/src/kilo/ports.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest';
+import { PORT_RANGE_MAX, PORT_RANGE_MIN, randomPort } from './ports.js';
+
+describe('port constants', () => {
+  it('PORT_RANGE_MIN is 10000', () => {
+    expect(PORT_RANGE_MIN).toBe(10000);
+  });
+
+  it('PORT_RANGE_MAX is 60000', () => {
+    expect(PORT_RANGE_MAX).toBe(60000);
+  });
+});
+
+describe('randomPort', () => {
+  it('returns a number within [PORT_RANGE_MIN, PORT_RANGE_MAX)', () => {
+    for (let i = 0; i < 100; i++) {
+      const port = randomPort();
+      expect(port).toBeGreaterThanOrEqual(PORT_RANGE_MIN);
+      expect(port).toBeLessThan(PORT_RANGE_MAX);
+    }
+  });
+
+  it('returns integers', () => {
+    for (let i = 0; i < 100; i++) {
+      const port = randomPort();
+      expect(Number.isInteger(port)).toBe(true);
+    }
+  });
+
+  it('produces varying results across multiple calls', () => {
+    const ports = new Set<number>();
+    for (let i = 0; i < 100; i++) {
+      ports.add(randomPort());
+    }
+    expect(ports.size).toBeGreaterThanOrEqual(2);
+  });
+});

cloud-agent-next/src/kilo/ports.ts

@@ -0,0 +1,8 @@
+// Range partially overlaps the Linux ephemeral range (32768–60999), but in an
+// isolated container a 50k-port range makes collisions statistically negligible.
+export const PORT_RANGE_MIN = 10000;
+export const PORT_RANGE_MAX = 60000;
+
+export function randomPort(): number {
+  return PORT_RANGE_MIN + Math.floor(Math.random() * (PORT_RANGE_MAX - PORT_RANGE_MIN));
+}