feat(bot): handle pr and mr comment requests

[alex-alecu]

Summary

• Enable Kilo Bot on GitLab merge request comments so linked users can start Cloud Agent work from GitLab.
• Detect clear requests for a separate PR or MR and guide Cloud Agent to use a fresh branch instead of the current review branch.
• Add branch context for GitHub PRs and GitLab MRs so new PR/MR requests use the right target.

Verification

1. Mention Kilo on a GitHub PR comment and ask it to open a new PR; confirm the Cloud Agent request says to use a fresh branch from the PR base branch.
2. Mention Kilo on a GitLab MR note from a linked account; confirm the bot starts work and replies back in the MR thread.
3. Use the GitLab link from an MR comment as an unlinked user; confirm OAuth links the GitLab account.

Visual Changes

N/A

Reviewer Notes

Existing GitLab project webhooks need to be synced or updated so they send note events.

[kilo-code-bot]

WARNING: Wrong documentation URL — points to the Slack platform page instead of GitLab.

documentationUrl is set to 'https://kilo.ai/docs/code-with-ai/platforms/slack'. This will misdirect any user or tooling that follows this URL. It should point to the GitLab-specific docs page (or a placeholder if that page doesn't exist yet).

Suggested change

	documentationUrl: 'https://kilo.ai/docs/code-with-ai/platforms/slack',
	documentationUrl: 'https://kilo.ai/docs/code-with-ai/platforms/gitlab',

[kilo-code-bot]

WARNING: bot_enabled can never be re-enabled once disabled.

This guard prevents re-enabling the bot via a GitHub App re-installation or any other path that passes { bot_enabled: true }. Once an admin disables the bot by setting bot_enabled: false, there is no programmatic way to flip it back to true — every install/update call will silently be overridden back to false here.

If the intent is to make bot_enabled: false sticky, this is a one-way door with no escape hatch. Consider whether an explicit admin action (e.g. a dedicated tRPC mutation) is needed to override this, or at minimum document why re-enabling via installation is intentionally blocked.

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

The GitLab bot platform has a wrong documentation URL pointing to the Slack docs, and a logic gate in mergeIntegrationMetadata permanently prevents re-enabling the bot once it has been disabled.

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/bot/platforms/gitlab.ts	404	documentationUrl points to the Slack docs page (/platforms/slack) instead of GitLab
apps/web/src/lib/integrations/db/platform-integrations.ts	30	mergeIntegrationMetadata permanently blocks re-enabling bot_enabled once it is set to false — there is no escape hatch

Files Reviewed (14 files)

• apps/web/src/app/api/integrations/github/callback/route.ts
• apps/web/src/app/api/integrations/gitlab/callback/route.ts
• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.ts
• apps/web/src/app/api/webhooks/gitlab/route.ts
• apps/web/src/app/gitlab/link/route.ts
• apps/web/src/lib/bot.ts
• apps/web/src/lib/bot/agent-runner.ts
• apps/web/src/lib/bot/gitlab-link-state.ts
• apps/web/src/lib/bot/gitlab-link-token.ts
• apps/web/src/lib/bot/handle-mention.ts
• apps/web/src/lib/bot/platforms/github.ts
• apps/web/src/lib/bot/platforms/gitlab.ts — 1 issue
• apps/web/src/lib/bot/platforms/registry.ts
• apps/web/src/lib/bot/pr-creation-strategy.ts
• apps/web/src/lib/bot/run.ts
• apps/web/src/lib/bot/tools/spawn-cloud-agent-session.ts
• apps/web/src/lib/integrations/db/platform-integrations.ts — 1 issue
• apps/web/src/lib/integrations/gitlab-service.ts
• apps/web/src/lib/integrations/platforms/gitlab/adapter.ts
• apps/web/src/lib/integrations/platforms/gitlab/webhook-handlers/bot-note-handler.ts
• apps/web/src/lib/integrations/platforms/gitlab/webhook-schemas.ts
• apps/web/src/routers/github-apps-router.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-4.6 · 4,282,507 tokens}

_{Review guidance: REVIEW.md from base branch main}