From 50300ff80ea5609015e8173f2cbf051d2edf033d Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 15:14:59 -0700
Subject: [PATCH 01/20] =?UTF-8?q?wip:=20clawbyte=20install=20flow=20?=
 =?UTF-8?q?=E2=80=94=20signed-payload=20verification=20+=20kilo-chat=20HTT?=
 =?UTF-8?q?P?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

  Lays the foundation for app.kilo.ai 1-click install of ClawBytes from
  kilo.ai. Not yet wired end-to-end (no tRPC mutation, no client
  dispatch, no cookie-through-provisioning); this stages the
  verification, registry, and per-user chat-injection HTTP surface.

  apps/web (cloud Next.js):
  - lib/kiloclaw/install-sources.ts: generalized source registry. v1
    ships a single `byte` source mapped to kilo.ai's data.json
    endpoint; KILO_AI_BASE_URL overrides for local dev. Adding a new
    source = appending one map entry.
  - lib/kiloclaw/install.ts: fetchInstallPayload(source, slug) does
    Zod parse + Ed25519 signature verify against pinned
    CLAWBYTE_SIGNING_PUBLIC_KEY. Rejects on missing key, kid
    mismatch, expired/future signedAt, version drift, or tampered
    envelope. Returns null on hard rejects so callers can't fall back
    to unsigned content.
  - lib/kiloclaw/install.test.ts: 11 cases covering happy ph,
    upstream 4xx/5xx, kid mismatch, tampered prompt/title, version
    drift, age window, unsigned payloads, and unconfigured pubkey.
  - app/(app)/claw/install/[source]/[slug]/page.tsx +
    InstallClient.tsx: server route fetches the payload behind the
    existing claw-layout auth gate; client shell renders a preview
    with title/description and a placeholder for the dispatch CTA.

  services/kilo-chat (Cloudflare Worker):
  - routes/internal.ts + auth-internal.ts: new /internal/v1/post-
    message-as-user HTTP endpoint, gated by an x-internal-api-key
    header verified against INTERNAL_API_SECRET. Thin wrapper around
    the existing postMessageAsUser RPC so non-Worker callers (the
    cloud Next.js app) can deliver an as-user chat turn without
    needing a service binding.
  - wrangler.jsonc: adds the INTERNAL_API_SECRET secrets-store
    binding (shared store, prod secret).
  - worker-configuration.d.ts: regenerated to include the new
    binding.
---
 .../install/[source]/[slug]/InstallClient.tsx |  35 ++++
 .../claw/install/[source]/[slug]/page.tsx     |  21 ++
 apps/web/src/lib/kiloclaw/install-sources.ts  |  16 ++
 apps/web/src/lib/kiloclaw/install.test.ts     | 198 ++++++++++++++++++
 apps/web/src/lib/kiloclaw/install.ts          | 140 +++++++++++++
 services/kilo-chat/src/auth-internal.ts       |  37 ++++
 services/kilo-chat/src/index.ts               |   7 +
 services/kilo-chat/src/routes/internal.ts     |  56 +++++
 services/kilo-chat/worker-configuration.d.ts  |   3 +-
 services/kilo-chat/wrangler.jsonc             |   5 +
 10 files changed, 517 insertions(+), 1 deletion(-)
 create mode 100644 apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
 create mode 100644 apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
 create mode 100644 apps/web/src/lib/kiloclaw/install-sources.ts
 create mode 100644 apps/web/src/lib/kiloclaw/install.test.ts
 create mode 100644 apps/web/src/lib/kiloclaw/install.ts
 create mode 100644 services/kilo-chat/src/auth-internal.ts
 create mode 100644 services/kilo-chat/src/routes/internal.ts

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
new file mode 100644
index 0000000000..3aeaeafa22
--- /dev/null
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -0,0 +1,35 @@
+'use client';
+
+import Link from 'next/link';
+import { Loader2 } from 'lucide-react';
+import type { InstallPayload } from '@/lib/kiloclaw/install';
+import type { InstallSource } from '@/lib/kiloclaw/install-sources';
+
+type InstallClientProps = {
+  source: InstallSource;
+  sourceLabel: string;
+  payload: InstallPayload;
+};
+
+export function InstallClient({ source, sourceLabel, payload }: InstallClientProps) {
+  return (
+    <div className="mx-auto flex min-h-[60vh] max-w-xl flex-col items-center justify-center gap-4 px-6 py-12 text-center">
+      <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" aria-hidden />
+      <p className="text-sm uppercase tracking-wide text-muted-foreground">
+        Installing {sourceLabel}
+      </p>
+      <h1 className="text-2xl font-semibold">{payload.title}</h1>
+      {payload.tagline ? (
+        <p className="text-base text-muted-foreground">{payload.tagline}</p>
+      ) : null}
+      <p className="text-sm text-muted-foreground">{payload.description}</p>
+      <p className="mt-4 text-xs text-muted-foreground">
+        Install dispatch wiring is pending — this page currently renders the preview only. Source:{' '}
+        <code>{source}</code> · Slug: <code>{payload.slug}</code>
+      </p>
+      <Link href="/claw/chat" className="text-sm text-primary underline">
+        Cancel
+      </Link>
+    </div>
+  );
+}
diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
new file mode 100644
index 0000000000..b3febb0bad
--- /dev/null
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
@@ -0,0 +1,21 @@
+import { notFound } from 'next/navigation';
+import { fetchInstallPayload } from '@/lib/kiloclaw/install';
+import { INSTALL_SOURCES, isInstallSource } from '@/lib/kiloclaw/install-sources';
+import { InstallClient } from './InstallClient';
+
+type InstallPageProps = {
+  params: Promise<{ source: string; slug: string }>;
+};
+
+export default async function InstallPage({ params }: InstallPageProps) {
+  const { source, slug } = await params;
+
+  if (!isInstallSource(source)) notFound();
+
+  const payload = await fetchInstallPayload(source, slug);
+  if (!payload) notFound();
+
+  return (
+    <InstallClient source={source} sourceLabel={INSTALL_SOURCES[source].label} payload={payload} />
+  );
+}
diff --git a/apps/web/src/lib/kiloclaw/install-sources.ts b/apps/web/src/lib/kiloclaw/install-sources.ts
new file mode 100644
index 0000000000..8887ad3b41
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/install-sources.ts
@@ -0,0 +1,16 @@
+const KILO_AI_BASE = (process.env.KILO_AI_BASE_URL ?? 'https://kilo.ai').replace(/\/$/, '');
+
+export const INSTALL_SOURCES = {
+  byte: {
+    label: 'ClawByte',
+    urlTemplate: `${KILO_AI_BASE}/kiloclaw/bytes/{slug}/data.json`,
+  },
+} as const;
+
+export type InstallSource = keyof typeof INSTALL_SOURCES;
+
+export const INSTALL_SOURCE_KEYS = Object.keys(INSTALL_SOURCES) as InstallSource[];
+
+export function isInstallSource(value: string): value is InstallSource {
+  return value in INSTALL_SOURCES;
+}
diff --git a/apps/web/src/lib/kiloclaw/install.test.ts b/apps/web/src/lib/kiloclaw/install.test.ts
new file mode 100644
index 0000000000..55690c6314
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/install.test.ts
@@ -0,0 +1,198 @@
+import crypto from 'node:crypto';
+
+// Generate a real Ed25519 keypair once for the whole test file. Tests sign
+// fixtures with the private half and pin the public half via env var.
+const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');
+const PRIVATE_PEM = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+const PUBLIC_PEM = publicKey.export({ type: 'spki', format: 'pem' }) as string;
+
+// Derive the matching kid the way the signer / verifier do.
+const PUBLIC_DER = publicKey.export({ type: 'spki', format: 'der' });
+const EXPECTED_KID = crypto
+  .createHash('sha256')
+  .update(PUBLIC_DER)
+  .digest('base64url')
+  .slice(0, 16);
+
+// Configure env BEFORE importing the module under test so the install
+// fetcher's env lookups see the right key.
+process.env.CLAWBYTE_SIGNING_PUBLIC_KEY = PUBLIC_PEM;
+
+// eslint-disable-next-line import/first
+import { fetchInstallPayload } from './install';
+
+type RawPayload = {
+  slug: string;
+  title: string;
+  description: string;
+  prompt: string;
+  tagline?: string;
+  category?: string;
+  tags?: string[];
+  signature?: string;
+  signatureKeyId?: string;
+  signedAt?: string;
+  signatureVersion?: number;
+};
+
+function signPayload(
+  base: Omit<RawPayload, 'signature' | 'signatureKeyId' | 'signedAt' | 'signatureVersion'>,
+  overrides: Partial<Pick<RawPayload, 'signatureKeyId' | 'signedAt' | 'signatureVersion'>> = {},
+  signWith: crypto.KeyObject = privateKey
+): RawPayload {
+  const signatureVersion = overrides.signatureVersion ?? 1;
+  const signatureKeyId = overrides.signatureKeyId ?? EXPECTED_KID;
+  const signedAt = overrides.signedAt ?? new Date().toISOString();
+  const envelope = JSON.stringify({
+    v: signatureVersion,
+    kid: signatureKeyId,
+    slug: base.slug,
+    title: base.title,
+    description: base.description,
+    prompt: base.prompt,
+    signedAt,
+  });
+  const signature = crypto.sign(null, Buffer.from(envelope, 'utf8'), signWith).toString('base64');
+  return { ...base, signature, signatureKeyId, signedAt, signatureVersion };
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+const VALID_BASE = {
+  slug: 'deep-research',
+  title: 'Source Hunter',
+  description: 'Deep research that finds primary sources.',
+  prompt: 'Research [topic] for me.',
+};
+
+describe('fetchInstallPayload', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('returns the parsed payload for a valid signed response', async () => {
+    const signed = signPayload(VALID_BASE);
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).not.toBeNull();
+    expect(result?.slug).toBe('deep-research');
+    expect(result?.prompt).toBe('Research [topic] for me.');
+    expect(result?.signatureKeyId).toBe(EXPECTED_KID);
+  });
+
+  it('returns null when upstream is 404', async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue(new Response(null, { status: 404 }));
+    const result = await fetchInstallPayload('byte', 'missing-slug');
+    expect(result).toBeNull();
+  });
+
+  it('throws when upstream is non-OK and non-404', async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue(new Response('boom', { status: 500 }));
+    await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow(/500/);
+  });
+
+  it('rejects payload signed by a different key (kid mismatch)', async () => {
+    const { privateKey: foreignPriv, publicKey: foreignPub } =
+      crypto.generateKeyPairSync('ed25519');
+    const foreignKid = crypto
+      .createHash('sha256')
+      .update(foreignPub.export({ type: 'spki', format: 'der' }))
+      .digest('base64url')
+      .slice(0, 16);
+    const signed = signPayload(VALID_BASE, { signatureKeyId: foreignKid }, foreignPriv);
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('key id mismatch'));
+  });
+
+  it('rejects tampered prompt (signature no longer verifies)', async () => {
+    const signed = signPayload(VALID_BASE);
+    const tampered = { ...signed, prompt: 'MALICIOUS PROMPT' };
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(tampered));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('signature did not verify'));
+  });
+
+  it('rejects tampered title (signature no longer verifies)', async () => {
+    const signed = signPayload(VALID_BASE);
+    const tampered = { ...signed, title: 'Different Title' };
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(tampered));
+    jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+    expect(result).toBeNull();
+  });
+
+  it('rejects an unsupported signature version', async () => {
+    const signed = signPayload(VALID_BASE, { signatureVersion: 99 });
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('unsupported signature version'));
+  });
+
+  it('rejects a signature older than the TTL', async () => {
+    const ancient = new Date(Date.now() - 31 * 24 * 60 * 60 * 1000).toISOString();
+    const signed = signPayload(VALID_BASE, { signedAt: ancient });
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('too old'));
+  });
+
+  it('rejects a signature with signedAt in the future', async () => {
+    const future = new Date(Date.now() + 60 * 60 * 1000).toISOString(); // +1h
+    const signed = signPayload(VALID_BASE, { signedAt: future });
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('in the future'));
+  });
+
+  it('rejects an unsigned payload via Zod parse', async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(VALID_BASE));
+    await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow();
+  });
+
+  it('throws when CLAWBYTE_SIGNING_PUBLIC_KEY is unset', async () => {
+    const saved = process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
+    delete process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
+    try {
+      const signed = signPayload(VALID_BASE);
+      jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+      jest.spyOn(console, 'error').mockImplementation(() => {});
+
+      // getPublicKey throws inside verifySignedPayload; the throw propagates
+      // out of fetchInstallPayload since we don't catch it there.
+      await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow(
+        /CLAWBYTE_SIGNING_PUBLIC_KEY is not configured/
+      );
+    } finally {
+      process.env.CLAWBYTE_SIGNING_PUBLIC_KEY = saved;
+    }
+  });
+});
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
new file mode 100644
index 0000000000..094237156d
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -0,0 +1,140 @@
+import crypto from 'node:crypto';
+import { z } from 'zod';
+import { INSTALL_SOURCES, type InstallSource } from './install-sources';
+
+/**
+ * Ed25519 signature verification for install payloads.
+ *
+ * The signed envelope and key-id derivation match the signer's exact shape
+ * in kilocode-landing's `src/lib/crabbytes-signing.ts`. If you change either
+ * side (envelope fields, key order, kid derivation), update both files
+ * together — otherwise verification will silently fail.
+ */
+const SUPPORTED_SIGNATURE_VERSION = 1;
+
+// Reject signatures older than this. Prevents an attacker who manages to
+// capture a one-time signed payload from replaying it indefinitely after a
+// later key rotation or content takedown. 30 days is generous; tighten if
+// the byte catalog churns frequently.
+const MAX_SIGNATURE_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+
+const installPayloadSchema = z.object({
+  slug: z.string().min(1).max(200),
+  title: z.string().max(500),
+  description: z.string().max(2000),
+  prompt: z.string().min(1).max(32000),
+  tagline: z.string().max(500).optional(),
+  category: z.string().max(100).optional(),
+  tags: z.array(z.string().max(100)).max(50).optional(),
+  // Signature fields. All four are required — an unsigned payload fails
+  // Zod parsing before reaching the crypto verify step.
+  signature: z.string().min(1).max(200), // base64 Ed25519 sig (~88 chars)
+  signatureKeyId: z.string().min(1).max(64),
+  signedAt: z.string().datetime(),
+  signatureVersion: z.number().int().positive(),
+});
+
+export type InstallPayload = z.infer<typeof installPayloadSchema>;
+
+function getPublicKey(): crypto.KeyObject {
+  const raw = process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
+  if (!raw) {
+    throw new Error(
+      'CLAWBYTE_SIGNING_PUBLIC_KEY is not configured — install payloads cannot be verified'
+    );
+  }
+  const pem = raw.replace(/\\n/g, '\n').trim();
+  return crypto.createPublicKey({ key: pem, format: 'pem' });
+}
+
+function deriveKeyId(publicKey: crypto.KeyObject): string {
+  const der = publicKey.export({ type: 'spki', format: 'der' });
+  return crypto.createHash('sha256').update(der).digest('base64url').slice(0, 16);
+}
+
+function canonicalEnvelopeString(payload: InstallPayload): string {
+  // MUST match the signer's exact key order. Append-only if the envelope
+  // evolves; bump SUPPORTED_SIGNATURE_VERSION alongside the change.
+  return JSON.stringify({
+    v: payload.signatureVersion,
+    kid: payload.signatureKeyId,
+    slug: payload.slug,
+    title: payload.title,
+    description: payload.description,
+    prompt: payload.prompt,
+    signedAt: payload.signedAt,
+  });
+}
+
+type VerifyOk = { ok: true };
+type VerifyErr = { ok: false; reason: string };
+
+function verifySignedPayload(payload: InstallPayload): VerifyOk | VerifyErr {
+  if (payload.signatureVersion !== SUPPORTED_SIGNATURE_VERSION) {
+    return {
+      ok: false,
+      reason: `unsupported signature version ${payload.signatureVersion} (expected ${SUPPORTED_SIGNATURE_VERSION})`,
+    };
+  }
+
+  const ageMs = Date.now() - Date.parse(payload.signedAt);
+  if (!Number.isFinite(ageMs)) {
+    return { ok: false, reason: 'signedAt is not a valid date' };
+  }
+  if (ageMs > MAX_SIGNATURE_AGE_MS) {
+    return { ok: false, reason: `signature too old (signedAt=${payload.signedAt})` };
+  }
+  if (ageMs < -5 * 60 * 1000) {
+    // Allow ~5 min of clock skew either way; anything further in the future
+    // is suspicious.
+    return { ok: false, reason: `signedAt is in the future (signedAt=${payload.signedAt})` };
+  }
+
+  const publicKey = getPublicKey();
+  const expectedKid = deriveKeyId(publicKey);
+  if (payload.signatureKeyId !== expectedKid) {
+    return {
+      ok: false,
+      reason: `signature key id mismatch (payload=${payload.signatureKeyId}, pinned=${expectedKid})`,
+    };
+  }
+
+  const canonical = canonicalEnvelopeString(payload);
+  const sigBytes = Buffer.from(payload.signature, 'base64');
+  const valid = crypto.verify(null, Buffer.from(canonical, 'utf8'), publicKey, sigBytes);
+  if (!valid) {
+    return { ok: false, reason: 'Ed25519 signature did not verify against pinned public key' };
+  }
+
+  return { ok: true };
+}
+
+export async function fetchInstallPayload(
+  source: InstallSource,
+  slug: string
+): Promise<InstallPayload | null> {
+  const url = INSTALL_SOURCES[source].urlTemplate.replace('{slug}', encodeURIComponent(slug));
+  const res = await fetch(url, { next: { revalidate: 300 } });
+
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new Error(`fetchInstallPayload(${source}, ${slug}): ${res.status} ${res.statusText}`);
+  }
+
+  const json = await res.json();
+  const payload = installPayloadSchema.parse(json);
+
+  const verify = verifySignedPayload(payload);
+  if (!verify.ok) {
+    // Treat verification failure as a hard reject — the caller surfaces
+    // this as an install-not-allowed error to the user. Logging the reason
+    // server-side so on-call can distinguish "byte deleted upstream" (404)
+    // from "byte tampered or key rotated" (verify failure).
+    console.error(
+      `[install] signature verification failed for ${source}/${slug}: ${verify.reason}`
+    );
+    return null;
+  }
+
+  return payload;
+}
diff --git a/services/kilo-chat/src/auth-internal.ts b/services/kilo-chat/src/auth-internal.ts
new file mode 100644
index 0000000000..6602151a7e
--- /dev/null
+++ b/services/kilo-chat/src/auth-internal.ts
@@ -0,0 +1,37 @@
+import { createMiddleware } from 'hono/factory';
+import { timingSafeEqual } from '@kilocode/encryption';
+import { logger } from './util/logger';
+import type { AuthContext } from './auth';
+
+/**
+ * Internal API auth — verifies the `x-internal-api-key` header against the
+ * `INTERNAL_API_SECRET` env binding. Mirrors the pattern in
+ * `services/kiloclaw/src/auth/middleware.ts`.
+ *
+ * Applied to routes under `/internal/*` that are called server-to-server
+ * by trusted callers (e.g. the cloud Next.js web app's tRPC mutations).
+ * The caller passes `userId` etc. in the request body — there is no JWT.
+ */
+export const internalApiMiddleware = createMiddleware<{
+  Bindings: Env;
+  Variables: AuthContext;
+}>(async (c, next) => {
+  let secret: string;
+  try {
+    secret = await c.env.INTERNAL_API_SECRET.get();
+  } catch (err) {
+    logger.error('Failed to read INTERNAL_API_SECRET', { err: String(err) });
+    return c.json({ error: 'Server configuration error' }, 500);
+  }
+  if (!secret) {
+    logger.error('INTERNAL_API_SECRET not configured');
+    return c.json({ error: 'Server configuration error' }, 500);
+  }
+
+  const apiKey = c.req.header('x-internal-api-key');
+  if (!apiKey) return c.json({ error: 'Forbidden' }, 403);
+  if (!timingSafeEqual(apiKey, secret)) return c.json({ error: 'Forbidden' }, 403);
+
+  logger.setTags({ source: 'internal-api' });
+  return next();
+});
diff --git a/services/kilo-chat/src/index.ts b/services/kilo-chat/src/index.ts
index d3fbdff85e..2d0ebe8f5b 100644
--- a/services/kilo-chat/src/index.ts
+++ b/services/kilo-chat/src/index.ts
@@ -9,6 +9,7 @@ import { logger, withLogTags } from './util/logger';
 import { formatError } from '@kilocode/worker-utils';
 import { authMiddleware } from './auth';
 import { botAuthMiddleware } from './auth-bot';
+import { internalApiMiddleware } from './auth-internal';
 import type { AuthContext } from './auth';
 import { decodeConversationCursor, type ConversationCursor } from '@kilocode/kilo-chat';
 import { registerConversationRoutes } from './routes/conversations';
@@ -26,6 +27,7 @@ import {
   handleStopTyping,
 } from './routes/handler';
 import { registerBotRoutes } from './routes/bot-messages';
+import { registerInternalRoutes } from './routes/internal';
 import { registerSandboxReadRoutes } from './routes/sandbox-reads';
 import {
   postMessageAsUser,
@@ -105,6 +107,11 @@ app.get('/v1/attachments/:id/url', handleAttachmentGetUrl);
 app.use('/bot/v1/sandboxes/:sandboxId/*', botAuthMiddleware);
 registerBotRoutes(app);
 
+// Internal HTTP routes — `x-internal-api-key` shared-secret auth, called
+// server-to-server by trusted callers (e.g. the Next.js cloud web app).
+app.use('/internal/*', internalApiMiddleware);
+registerInternalRoutes(app);
+
 export class KiloChatService extends WorkerEntrypoint<Env> {
   async fetch(request: Request): Promise<Response> {
     return app.fetch(request, this.env, this.ctx);
diff --git a/services/kilo-chat/src/routes/internal.ts b/services/kilo-chat/src/routes/internal.ts
new file mode 100644
index 0000000000..4d94498033
--- /dev/null
+++ b/services/kilo-chat/src/routes/internal.ts
@@ -0,0 +1,56 @@
+import type { Hono } from 'hono';
+import type { ContentfulStatusCode } from 'hono/utils/http-status';
+import { z } from 'zod';
+import type { AuthContext } from '../auth';
+import { logger } from '../util/logger';
+import { postMessageAsUser } from '../services/post-message-as-user';
+
+const postMessageAsUserBodySchema = z.object({
+  userId: z.string().min(1),
+  sandboxId: z.string().min(1),
+  message: z.string().min(1),
+  source: z.string().min(1).max(64),
+  autoCreateConversation: z.boolean().optional(),
+  correlation: z
+    .object({
+      triggerId: z.string().optional(),
+      webhookRequestId: z.string().optional(),
+      reason: z.string().optional(),
+    })
+    .optional(),
+});
+
+/**
+ * HTTP wrapper around the `postMessageAsUser` RPC primitive, for callers
+ * that don't run on Cloudflare Workers (e.g. the Next.js cloud web app).
+ * Mounted under `/internal/v1/*` behind `internalApiMiddleware`.
+ */
+export function registerInternalRoutes(app: Hono<{ Bindings: Env; Variables: AuthContext }>) {
+  app.post('/internal/v1/post-message-as-user', async c => {
+    const raw = await c.req.json().catch(() => null);
+    const parsed = postMessageAsUserBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return c.json({ ok: false, code: 'invalid_request', error: parsed.error.message }, 400);
+    }
+
+    const result = await postMessageAsUser(
+      c.env,
+      { waitUntil: p => c.executionCtx.waitUntil(p) },
+      parsed.data
+    );
+
+    if (result.ok) return c.json(result, 200);
+
+    const statusFromCode: Record<typeof result.code, ContentfulStatusCode> = {
+      invalid_request: 400,
+      forbidden: 403,
+      no_conversation: 404,
+      internal: 500,
+    };
+    logger.warn('internal post-message-as-user failed', {
+      code: result.code,
+      source: parsed.data.source,
+    });
+    return c.json(result, statusFromCode[result.code]);
+  });
+}
diff --git a/services/kilo-chat/worker-configuration.d.ts b/services/kilo-chat/worker-configuration.d.ts
index db185eca07..2fdef3745e 100644
--- a/services/kilo-chat/worker-configuration.d.ts
+++ b/services/kilo-chat/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 8515390d8c3a2362c468146961683341)
+// Generated by Wrangler by running `wrangler types` (hash: 9a65316f3ede92753a3993b9ca864eae)
 // Runtime types generated with workerd@1.20260508.1 2026-04-25 nodejs_compat
 declare namespace Cloudflare {
 	interface GlobalProps {
@@ -13,6 +13,7 @@ declare namespace Cloudflare {
 		GATEWAY_TOKEN_SECRET: SecretsStoreSecret;
 		R2_ACCESS_KEY_ID: SecretsStoreSecret;
 		R2_SECRET_ACCESS_KEY: SecretsStoreSecret;
+		INTERNAL_API_SECRET: SecretsStoreSecret;
 		R2_ACCOUNT_ID: "e115e769bcdd4c3d66af59d3332cb394";
 		R2_BUCKET_NAME: "kilo-chat-media";
 		KEY_PREFIX: "";
diff --git a/services/kilo-chat/wrangler.jsonc b/services/kilo-chat/wrangler.jsonc
index e2493232bc..2e2638c652 100644
--- a/services/kilo-chat/wrangler.jsonc
+++ b/services/kilo-chat/wrangler.jsonc
@@ -78,5 +78,10 @@
       "store_id": "342a86d9e3a94da698e82d0c6e2a36f0",
       "secret_name": "R2_SECRET_ACCESS_KEY_KILOCHAT_MEDIA",
     },
+    {
+      "binding": "INTERNAL_API_SECRET",
+      "store_id": "342a86d9e3a94da698e82d0c6e2a36f0",
+      "secret_name": "INTERNAL_API_SECRET_PROD",
+    },
   ],
 }

From 523dc79379349f2a9663e06816d145aba2fbb4d8 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 15:25:37 -0700
Subject: [PATCH 02/20] fix(install): address local review findings

---
 .../src/lib/kiloclaw/install-sources.test.ts  | 21 +++++++++++++++++++
 apps/web/src/lib/kiloclaw/install-sources.ts  |  6 +++---
 apps/web/src/lib/kiloclaw/install.test.ts     | 13 ++++++++++++
 apps/web/src/lib/kiloclaw/install.ts          | 12 +++++++++++
 services/kilo-chat/src/auth-internal.ts       |  7 +++++--
 5 files changed, 54 insertions(+), 5 deletions(-)
 create mode 100644 apps/web/src/lib/kiloclaw/install-sources.test.ts

diff --git a/apps/web/src/lib/kiloclaw/install-sources.test.ts b/apps/web/src/lib/kiloclaw/install-sources.test.ts
new file mode 100644
index 0000000000..5cdc167564
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/install-sources.test.ts
@@ -0,0 +1,21 @@
+import { isInstallSource } from './install-sources';
+
+describe('isInstallSource', () => {
+  it('accepts registered source keys', () => {
+    expect(isInstallSource('byte')).toBe(true);
+  });
+
+  it('rejects unknown sources', () => {
+    expect(isInstallSource('skill')).toBe(false);
+    expect(isInstallSource('')).toBe(false);
+  });
+
+  it('rejects inherited Object prototype names (own-property check)', () => {
+    // Naive `value in INSTALL_SOURCES` would pass these through and then
+    // crash downstream lookup. Object.hasOwn keeps them out.
+    expect(isInstallSource('toString')).toBe(false);
+    expect(isInstallSource('hasOwnProperty')).toBe(false);
+    expect(isInstallSource('constructor')).toBe(false);
+    expect(isInstallSource('__proto__')).toBe(false);
+  });
+});
diff --git a/apps/web/src/lib/kiloclaw/install-sources.ts b/apps/web/src/lib/kiloclaw/install-sources.ts
index 8887ad3b41..08b50af35d 100644
--- a/apps/web/src/lib/kiloclaw/install-sources.ts
+++ b/apps/web/src/lib/kiloclaw/install-sources.ts
@@ -9,8 +9,8 @@ export const INSTALL_SOURCES = {
 
 export type InstallSource = keyof typeof INSTALL_SOURCES;
 
-export const INSTALL_SOURCE_KEYS = Object.keys(INSTALL_SOURCES) as InstallSource[];
-
 export function isInstallSource(value: string): value is InstallSource {
-  return value in INSTALL_SOURCES;
+  // Own-property check (not `value in`) so inherited names like `toString`
+  // or `hasOwnProperty` can't pass the guard and then crash the lookup.
+  return Object.hasOwn(INSTALL_SOURCES, value);
 }
diff --git a/apps/web/src/lib/kiloclaw/install.test.ts b/apps/web/src/lib/kiloclaw/install.test.ts
index 55690c6314..f7d3e68933 100644
--- a/apps/web/src/lib/kiloclaw/install.test.ts
+++ b/apps/web/src/lib/kiloclaw/install.test.ts
@@ -178,6 +178,19 @@ describe('fetchInstallPayload', () => {
     await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow();
   });
 
+  it('rejects when signed payload.slug does not match the requested slug', async () => {
+    // A validly-signed byte for a different slug — protects against CDN /
+    // upstream swapping byte A's payload for a request targeting byte B.
+    const signed = signPayload({ ...VALID_BASE, slug: 'different-byte' });
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('slug mismatch'));
+  });
+
   it('throws when CLAWBYTE_SIGNING_PUBLIC_KEY is unset', async () => {
     const saved = process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
     delete process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
index 094237156d..00efa8b06b 100644
--- a/apps/web/src/lib/kiloclaw/install.ts
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -136,5 +136,17 @@ export async function fetchInstallPayload(
     return null;
   }
 
+  // The signature covers `payload.slug`, but we also need to bind that slug
+  // to the slug the user actually requested. Otherwise a CDN/cache/object-
+  // path swap (or a malicious intermediary serving a different validly-
+  // signed byte for the requested URL) would let one byte's install
+  // dispatch under another byte's name.
+  if (payload.slug !== slug) {
+    console.error(
+      `[install] slug mismatch for ${source}/${slug}: signed payload is for "${payload.slug}"`
+    );
+    return null;
+  }
+
   return payload;
 }
diff --git a/services/kilo-chat/src/auth-internal.ts b/services/kilo-chat/src/auth-internal.ts
index 6602151a7e..6f846aa2cf 100644
--- a/services/kilo-chat/src/auth-internal.ts
+++ b/services/kilo-chat/src/auth-internal.ts
@@ -16,6 +16,11 @@ export const internalApiMiddleware = createMiddleware<{
   Bindings: Env;
   Variables: AuthContext;
 }>(async (c, next) => {
+  // Reject missing-header probes immediately, before hitting Secrets Store.
+  // Unauthenticated traffic shouldn't generate backend secret reads.
+  const apiKey = c.req.header('x-internal-api-key');
+  if (!apiKey) return c.json({ error: 'Forbidden' }, 403);
+
   let secret: string;
   try {
     secret = await c.env.INTERNAL_API_SECRET.get();
@@ -28,8 +33,6 @@ export const internalApiMiddleware = createMiddleware<{
     return c.json({ error: 'Server configuration error' }, 500);
   }
 
-  const apiKey = c.req.header('x-internal-api-key');
-  if (!apiKey) return c.json({ error: 'Forbidden' }, 403);
   if (!timingSafeEqual(apiKey, secret)) return c.json({ error: 'Forbidden' }, 403);
 
   logger.setTags({ source: 'internal-api' });

From 35c2c23d6c5897900d68f6e18c89d949f2de03ec Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 15:35:18 -0700
Subject: [PATCH 03/20] =?UTF-8?q?wip:=20cloud=20=E2=86=92=20kilo-chat=20HT?=
 =?UTF-8?q?TP=20client=20for=20internal=20post-message-as-user?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../kilo-chat-internal-client.test.ts         | 127 ++++++++++++++++++
 .../lib/kiloclaw/kilo-chat-internal-client.ts | 100 ++++++++++++++
 2 files changed, 227 insertions(+)
 create mode 100644 apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
 create mode 100644 apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts

diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
new file mode 100644
index 0000000000..7b3a68a726
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
@@ -0,0 +1,127 @@
+// Env must be set BEFORE importing the module under test so its constants
+// resolve to the test values.
+process.env.NEXT_PUBLIC_KILO_CHAT_URL = 'https://kilo-chat.test.example.com';
+
+jest.mock('@/lib/config.server', () => ({
+  INTERNAL_API_SECRET: 'test-internal-secret',
+}));
+
+import { postMessageAsUser } from './kilo-chat-internal-client';
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+const VALID_PARAMS = {
+  userId: 'user-123',
+  sandboxId: 'sandbox-456',
+  message: 'Hello from the install flow',
+  source: 'install',
+};
+
+describe('postMessageAsUser (cloud → kilo-chat internal HTTP)', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('POSTs to the internal route with the api key header and body', async () => {
+    const fetchSpy = jest.spyOn(global, 'fetch').mockResolvedValue(
+      jsonResponse({
+        ok: true,
+        conversationId: 'conv-1',
+        messageId: 'msg-1',
+        conversationCreated: false,
+      })
+    );
+
+    const result = await postMessageAsUser(VALID_PARAMS);
+
+    expect(result).toEqual({
+      ok: true,
+      conversationId: 'conv-1',
+      messageId: 'msg-1',
+      conversationCreated: false,
+    });
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchSpy.mock.calls[0]!;
+    expect(url).toBe('https://kilo-chat.test.example.com/internal/v1/post-message-as-user');
+    expect(init?.method).toBe('POST');
+    const headers = init?.headers as Record<string, string>;
+    expect(headers['x-internal-api-key']).toBe('test-internal-secret');
+    expect(headers['content-type']).toBe('application/json');
+    expect(init?.body).toBe(JSON.stringify(VALID_PARAMS));
+    expect(init?.cache).toBe('no-store');
+  });
+
+  it('returns a typed error result on 400 invalid_request', async () => {
+    jest
+      .spyOn(global, 'fetch')
+      .mockResolvedValue(
+        jsonResponse({ ok: false, code: 'invalid_request', error: 'message empty' }, 400)
+      );
+
+    const result = await postMessageAsUser(VALID_PARAMS);
+
+    expect(result).toEqual({
+      ok: false,
+      code: 'invalid_request',
+      error: 'message empty',
+    });
+  });
+
+  it('returns a typed error result on 404 no_conversation', async () => {
+    jest
+      .spyOn(global, 'fetch')
+      .mockResolvedValue(
+        jsonResponse({ ok: false, code: 'no_conversation', error: 'user has no conversation' }, 404)
+      );
+
+    const result = await postMessageAsUser(VALID_PARAMS);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.code).toBe('no_conversation');
+  });
+
+  it('returns forbidden when the middleware rejects (envelope-less 403)', async () => {
+    // `internalApiMiddleware` short-circuits before the route handler when
+    // the api-key header is missing/wrong, returning `{ error: 'Forbidden' }`
+    // rather than the discriminated-union shape. Client maps that to a
+    // typed `forbidden` result so callers don't need to know.
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse({ error: 'Forbidden' }, 403));
+
+    const result = await postMessageAsUser(VALID_PARAMS);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.code).toBe('forbidden');
+  });
+
+  it('throws on a non-JSON response', async () => {
+    jest
+      .spyOn(global, 'fetch')
+      .mockResolvedValue(new Response('plain text broken', { status: 502 }));
+
+    await expect(postMessageAsUser(VALID_PARAMS)).rejects.toThrow(/non-JSON response/);
+  });
+
+  it('throws on an unexpected JSON shape (non-403)', async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse({ totally: 'unexpected' }, 500));
+
+    await expect(postMessageAsUser(VALID_PARAMS)).rejects.toThrow(/unexpected payload/);
+  });
+
+  it('throws when NEXT_PUBLIC_KILO_CHAT_URL is missing', async () => {
+    const saved = process.env.NEXT_PUBLIC_KILO_CHAT_URL;
+    delete process.env.NEXT_PUBLIC_KILO_CHAT_URL;
+    try {
+      await expect(postMessageAsUser(VALID_PARAMS)).rejects.toThrow(
+        /NEXT_PUBLIC_KILO_CHAT_URL is not configured/
+      );
+    } finally {
+      process.env.NEXT_PUBLIC_KILO_CHAT_URL = saved;
+    }
+  });
+});
diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
new file mode 100644
index 0000000000..232fd6adaf
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
@@ -0,0 +1,100 @@
+import 'server-only';
+import { z } from 'zod';
+import type { PostMessageAsUserParams, PostMessageAsUserResult } from '@kilocode/kilo-chat';
+import { INTERNAL_API_SECRET } from '@/lib/config.server';
+
+/**
+ * Server-side HTTP client for kilo-chat's `/internal/v1/*` routes.
+ *
+ * The cloud Next.js app runs on Vercel (not Cloudflare), so it can't reach
+ * kilo-chat's `WorkerEntrypoint` RPC via service binding the way other
+ * Workers do. This client POSTs over plain HTTPS instead, gated by an
+ * `x-internal-api-key` header that kilo-chat's `internalApiMiddleware`
+ * timing-safe compares against `INTERNAL_API_SECRET`.
+ *
+ * Both env vars are required at runtime:
+ * - `NEXT_PUBLIC_KILO_CHAT_URL` — already used by the existing public
+ *   client-side kilo-chat token flow; we reuse it for the internal path.
+ * - `INTERNAL_API_SECRET` — shared secret with kilo-chat's Secrets Store
+ *   binding. Already used by other cloud → service integrations.
+ */
+
+const okSchema = z.object({
+  ok: z.literal(true),
+  conversationId: z.string(),
+  messageId: z.string(),
+  conversationCreated: z.boolean(),
+});
+
+const errSchema = z.object({
+  ok: z.literal(false),
+  code: z.enum(['invalid_request', 'no_conversation', 'forbidden', 'internal']),
+  error: z.string(),
+});
+
+const responseSchema = z.discriminatedUnion('ok', [okSchema, errSchema]);
+
+function getKiloChatBaseUrl(): string {
+  // We deliberately read process.env directly here rather than importing
+  // KILO_CHAT_URL from `@/lib/constants` — the constants file marks it as a
+  // *required* env var at import time, which causes test setups to crash if
+  // the var isn't set. This server-only client should fail loudly only when
+  // it's actually called.
+  const raw = process.env.NEXT_PUBLIC_KILO_CHAT_URL;
+  if (!raw) {
+    throw new Error(
+      'NEXT_PUBLIC_KILO_CHAT_URL is not configured — cannot reach kilo-chat internal routes'
+    );
+  }
+  return raw.replace(/\/$/, '');
+}
+
+export async function postMessageAsUser(
+  params: PostMessageAsUserParams
+): Promise<PostMessageAsUserResult> {
+  if (!INTERNAL_API_SECRET) {
+    throw new Error(
+      'INTERNAL_API_SECRET is not configured — cannot authenticate to kilo-chat internal routes'
+    );
+  }
+
+  const url = `${getKiloChatBaseUrl()}/internal/v1/post-message-as-user`;
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'x-internal-api-key': INTERNAL_API_SECRET,
+    },
+    body: JSON.stringify(params),
+    // Internal-only call between services; no caching.
+    cache: 'no-store',
+  });
+
+  // kilo-chat's internal route always returns a JSON body whether the
+  // outcome is ok:true (200) or ok:false (400/403/404/500). Parse first,
+  // then validate against the discriminated union so callers get a typed
+  // result regardless of HTTP status.
+  let body: unknown;
+  try {
+    body = await res.json();
+  } catch (err) {
+    throw new Error(
+      `kilo-chat /internal/v1/post-message-as-user returned non-JSON response (HTTP ${res.status}): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+
+  const parsed = responseSchema.safeParse(body);
+  if (!parsed.success) {
+    // Most likely: 403 from `internalApiMiddleware` before reaching the
+    // route handler, which returns `{ error: 'Forbidden' }`. Surface that
+    // as `forbidden` so callers don't need to know about middleware shapes.
+    if (res.status === 403) {
+      return { ok: false, code: 'forbidden', error: 'kilo-chat rejected the internal-api-key' };
+    }
+    throw new Error(
+      `kilo-chat /internal/v1/post-message-as-user returned unexpected payload (HTTP ${res.status}): ${parsed.error.message}`
+    );
+  }
+
+  return parsed.data;
+}

From 946301a0875f12af4eea8f1fb334c1fb4eab8ced Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 15:45:26 -0700
Subject: [PATCH 04/20] fix(install): address local-review findings on the WIP
 install flow

---
 .../install/[source]/[slug]/InstallClient.tsx | 27 ++++--
 apps/web/src/lib/kiloclaw/install.test.ts     | 31 ++++--
 apps/web/src/lib/kiloclaw/install.ts          | 96 +++++++++++++++++--
 .../kilo-chat-internal-client.test.ts         | 29 ++++++
 .../lib/kiloclaw/kilo-chat-internal-client.ts | 66 +++++++------
 packages/kilo-chat/src/index.ts               |  5 +
 packages/kilo-chat/src/rpc-types.ts           | 24 +++++
 7 files changed, 228 insertions(+), 50 deletions(-)

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
index 3aeaeafa22..904ffeb42b 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -1,7 +1,6 @@
 'use client';
 
 import Link from 'next/link';
-import { Loader2 } from 'lucide-react';
 import type { InstallPayload } from '@/lib/kiloclaw/install';
 import type { InstallSource } from '@/lib/kiloclaw/install-sources';
 
@@ -11,21 +10,33 @@ type InstallClientProps = {
   payload: InstallPayload;
 };
 
+/**
+ * Preview-only shell. The signed payload has been fetched and verified
+ * server-side; this page shows the user what's about to be installed.
+ * Dispatch is intentionally not wired yet — the install mutation lands
+ * in the next slice on this branch and will replace the disabled CTA
+ * below with a real click-to-install button. Until then, the route
+ * deliberately does no install work; visiting it is safe.
+ */
 export function InstallClient({ source, sourceLabel, payload }: InstallClientProps) {
   return (
     <div className="mx-auto flex min-h-[60vh] max-w-xl flex-col items-center justify-center gap-4 px-6 py-12 text-center">
-      <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" aria-hidden />
-      <p className="text-sm uppercase tracking-wide text-muted-foreground">
-        Installing {sourceLabel}
-      </p>
+      <p className="text-sm uppercase tracking-wide text-muted-foreground">{sourceLabel} preview</p>
       <h1 className="text-2xl font-semibold">{payload.title}</h1>
       {payload.tagline ? (
         <p className="text-base text-muted-foreground">{payload.tagline}</p>
       ) : null}
       <p className="text-sm text-muted-foreground">{payload.description}</p>
-      <p className="mt-4 text-xs text-muted-foreground">
-        Install dispatch wiring is pending — this page currently renders the preview only. Source:{' '}
-        <code>{source}</code> · Slug: <code>{payload.slug}</code>
+      <button
+        type="button"
+        disabled
+        className="mt-2 cursor-not-allowed rounded-md border border-muted px-4 py-2 text-sm text-muted-foreground opacity-60"
+        title="Install dispatch is being wired in the next change on this branch."
+      >
+        Install (coming soon)
+      </button>
+      <p className="text-xs text-muted-foreground">
+        Source: <code>{source}</code> · Slug: <code>{payload.slug}</code>
       </p>
       <Link href="/claw/chat" className="text-sm text-primary underline">
         Cancel
diff --git a/apps/web/src/lib/kiloclaw/install.test.ts b/apps/web/src/lib/kiloclaw/install.test.ts
index f7d3e68933..5b47b689aa 100644
--- a/apps/web/src/lib/kiloclaw/install.test.ts
+++ b/apps/web/src/lib/kiloclaw/install.test.ts
@@ -191,21 +191,40 @@ describe('fetchInstallPayload', () => {
     expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('slug mismatch'));
   });
 
-  it('throws when CLAWBYTE_SIGNING_PUBLIC_KEY is unset', async () => {
+  it('returns null and logs when CLAWBYTE_SIGNING_PUBLIC_KEY is unset', async () => {
+    // Treat missing/unparseable verifier config as a verification failure
+    // rather than a thrown 500, so the install page returns a controlled
+    // "not available" (the route surfaces null as notFound()) and ops can
+    // distinguish it from "byte deleted upstream" via the log line.
     const saved = process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
     delete process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
     try {
       const signed = signPayload(VALID_BASE);
       jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
-      jest.spyOn(console, 'error').mockImplementation(() => {});
+      const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
 
-      // getPublicKey throws inside verifySignedPayload; the throw propagates
-      // out of fetchInstallPayload since we don't catch it there.
-      await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow(
-        /CLAWBYTE_SIGNING_PUBLIC_KEY is not configured/
+      const result = await fetchInstallPayload('byte', 'deep-research');
+
+      expect(result).toBeNull();
+      expect(errSpy).toHaveBeenCalledWith(
+        expect.stringContaining('CLAWBYTE_SIGNING_PUBLIC_KEY is not configured')
       );
     } finally {
       process.env.CLAWBYTE_SIGNING_PUBLIC_KEY = saved;
     }
   });
+
+  it('rejects an oversize upstream response', async () => {
+    // Build a JSON body that exceeds MAX_RESPONSE_BYTES (256 KiB) so the
+    // bounded reader bails out before Zod parsing even runs.
+    const huge = 'x'.repeat(300 * 1024);
+    const signed = signPayload({ ...VALID_BASE, description: huge });
+    jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(signed));
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/exceeded \d+ bytes|exceeds limit/));
+  });
 });
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
index 00efa8b06b..593d6b6d8e 100644
--- a/apps/web/src/lib/kiloclaw/install.ts
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -18,6 +18,14 @@ const SUPPORTED_SIGNATURE_VERSION = 1;
 // the byte catalog churns frequently.
 const MAX_SIGNATURE_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 
+// Bound the upstream response so a malicious or misbehaving source can't
+// force us to buffer and parse arbitrarily large JSON before Zod's per-
+// field caps fire. 256 KiB is well above any realistic signed byte
+// payload (`prompt` is capped at 32k, `description` at 2k, body etc. are
+// dropped by Zod) and well below memory-pressure thresholds for a Vercel
+// serverless render.
+const MAX_RESPONSE_BYTES = 256 * 1024;
+
 const installPayloadSchema = z.object({
   slug: z.string().min(1).max(200),
   title: z.string().max(500),
@@ -36,15 +44,15 @@ const installPayloadSchema = z.object({
 
 export type InstallPayload = z.infer<typeof installPayloadSchema>;
 
-function getPublicKey(): crypto.KeyObject {
+function getPublicKey(): crypto.KeyObject | null {
   const raw = process.env.CLAWBYTE_SIGNING_PUBLIC_KEY;
-  if (!raw) {
-    throw new Error(
-      'CLAWBYTE_SIGNING_PUBLIC_KEY is not configured — install payloads cannot be verified'
-    );
-  }
+  if (!raw) return null;
   const pem = raw.replace(/\\n/g, '\n').trim();
-  return crypto.createPublicKey({ key: pem, format: 'pem' });
+  try {
+    return crypto.createPublicKey({ key: pem, format: 'pem' });
+  } catch {
+    return null;
+  }
 }
 
 function deriveKeyId(publicKey: crypto.KeyObject): string {
@@ -91,6 +99,13 @@ function verifySignedPayload(payload: InstallPayload): VerifyOk | VerifyErr {
   }
 
   const publicKey = getPublicKey();
+  if (!publicKey) {
+    return {
+      ok: false,
+      reason:
+        'CLAWBYTE_SIGNING_PUBLIC_KEY is not configured or unparseable — verification unavailable',
+    };
+  }
   const expectedKid = deriveKeyId(publicKey);
   if (payload.signatureKeyId !== expectedKid) {
     return {
@@ -109,6 +124,43 @@ function verifySignedPayload(payload: InstallPayload): VerifyOk | VerifyErr {
   return { ok: true };
 }
 
+/**
+ * Read a response body as text, but bail out if it exceeds `maxBytes`.
+ * Returns null on overflow (caller logs and rejects).
+ */
+async function readBoundedText(res: Response, maxBytes: number): Promise<string | null> {
+  if (!res.body) return await res.text();
+  const reader = res.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (value) {
+      total += value.byteLength;
+      if (total > maxBytes) {
+        // Free the buffer; we're throwing this body away.
+        chunks.length = 0;
+        try {
+          await reader.cancel();
+        } catch {
+          // Cancel may reject if the stream is already terminating; safe to ignore.
+        }
+        return null;
+      }
+      chunks.push(value);
+    }
+  }
+  // Concatenate and decode as UTF-8.
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    merged.set(c, offset);
+    offset += c.byteLength;
+  }
+  return new TextDecoder('utf-8').decode(merged);
+}
+
 export async function fetchInstallPayload(
   source: InstallSource,
   slug: string
@@ -121,7 +173,35 @@ export async function fetchInstallPayload(
     throw new Error(`fetchInstallPayload(${source}, ${slug}): ${res.status} ${res.statusText}`);
   }
 
-  const json = await res.json();
+  // Fast-path reject when the server tells us the body is too big. Not all
+  // upstreams send a reliable Content-Length, so we still bound the body
+  // read below.
+  const declaredLength = Number(res.headers.get('content-length') ?? '');
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
+    console.error(
+      `[install] upstream Content-Length ${declaredLength} exceeds limit ${MAX_RESPONSE_BYTES} for ${source}/${slug}`
+    );
+    return null;
+  }
+
+  // Read as text with an explicit size cap so we never buffer a runaway
+  // body. (`res.text()` would buffer the whole stream first.) Parse JSON
+  // ourselves only after the size check passes.
+  const text = await readBoundedText(res, MAX_RESPONSE_BYTES);
+  if (text === null) {
+    console.error(
+      `[install] upstream response exceeded ${MAX_RESPONSE_BYTES} bytes for ${source}/${slug}`
+    );
+    return null;
+  }
+  let json: unknown;
+  try {
+    json = JSON.parse(text);
+  } catch (err) {
+    throw new Error(
+      `fetchInstallPayload(${source}, ${slug}): upstream returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
   const payload = installPayloadSchema.parse(json);
 
   const verify = verifySignedPayload(payload);
diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
index 7b3a68a726..583eb5d1aa 100644
--- a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
@@ -124,4 +124,33 @@ describe('postMessageAsUser (cloud → kilo-chat internal HTTP)', () => {
       process.env.NEXT_PUBLIC_KILO_CHAT_URL = saved;
     }
   });
+
+  it('returns a typed internal error when the request times out', async () => {
+    // Simulate AbortSignal.timeout firing by having fetch reject with a
+    // TimeoutError-named exception (which is what the browser/node fetch
+    // surface when AbortSignal.timeout aborts a request).
+    const timeoutErr = new Error('The operation was aborted due to timeout');
+    timeoutErr.name = 'TimeoutError';
+    jest.spyOn(global, 'fetch').mockRejectedValue(timeoutErr);
+
+    const result = await postMessageAsUser(VALID_PARAMS);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.code).toBe('internal');
+      expect(result.error).toMatch(/timed out/);
+    }
+  });
+
+  it('returns a typed internal error on a generic network failure', async () => {
+    jest.spyOn(global, 'fetch').mockRejectedValue(new Error('network down'));
+
+    const result = await postMessageAsUser(VALID_PARAMS);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.code).toBe('internal');
+      expect(result.error).toMatch(/network down|fetch failed/);
+    }
+  });
 });
diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
index 232fd6adaf..54d7f1b98f 100644
--- a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
@@ -1,8 +1,17 @@
 import 'server-only';
-import { z } from 'zod';
-import type { PostMessageAsUserParams, PostMessageAsUserResult } from '@kilocode/kilo-chat';
+import {
+  postMessageAsUserResultSchema,
+  type PostMessageAsUserParams,
+  type PostMessageAsUserResult,
+} from '@kilocode/kilo-chat';
 import { INTERNAL_API_SECRET } from '@/lib/config.server';
 
+// 5s is well above kilo-chat's expected p99 for postMessageAsUser
+// (~ a single DO RPC + a sendMessage) and well below Vercel's outer
+// serverless function timeout, so a stuck request fails fast with a
+// typed `internal` result instead of cascading into the wider request.
+const POST_MESSAGE_AS_USER_TIMEOUT_MS = 5_000;
+
 /**
  * Server-side HTTP client for kilo-chat's `/internal/v1/*` routes.
  *
@@ -19,21 +28,6 @@ import { INTERNAL_API_SECRET } from '@/lib/config.server';
  *   binding. Already used by other cloud → service integrations.
  */
 
-const okSchema = z.object({
-  ok: z.literal(true),
-  conversationId: z.string(),
-  messageId: z.string(),
-  conversationCreated: z.boolean(),
-});
-
-const errSchema = z.object({
-  ok: z.literal(false),
-  code: z.enum(['invalid_request', 'no_conversation', 'forbidden', 'internal']),
-  error: z.string(),
-});
-
-const responseSchema = z.discriminatedUnion('ok', [okSchema, errSchema]);
-
 function getKiloChatBaseUrl(): string {
   // We deliberately read process.env directly here rather than importing
   // KILO_CHAT_URL from `@/lib/constants` — the constants file marks it as a
@@ -59,16 +53,32 @@ export async function postMessageAsUser(
   }
 
   const url = `${getKiloChatBaseUrl()}/internal/v1/post-message-as-user`;
-  const res = await fetch(url, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      'x-internal-api-key': INTERNAL_API_SECRET,
-    },
-    body: JSON.stringify(params),
-    // Internal-only call between services; no caching.
-    cache: 'no-store',
-  });
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'x-internal-api-key': INTERNAL_API_SECRET,
+      },
+      body: JSON.stringify(params),
+      // Internal-only call between services; no caching.
+      cache: 'no-store',
+      signal: AbortSignal.timeout(POST_MESSAGE_AS_USER_TIMEOUT_MS),
+    });
+  } catch (err) {
+    // AbortSignal.timeout fires with a TimeoutError DOMException. Map to a
+    // typed `internal` result so callers don't have to know about fetch's
+    // abort/network failure modes; same shape regardless of cause.
+    const isTimeout = err instanceof Error && err.name === 'TimeoutError';
+    return {
+      ok: false,
+      code: 'internal',
+      error: isTimeout
+        ? `kilo-chat /internal/v1/post-message-as-user timed out after ${POST_MESSAGE_AS_USER_TIMEOUT_MS}ms`
+        : `kilo-chat /internal/v1/post-message-as-user fetch failed: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
 
   // kilo-chat's internal route always returns a JSON body whether the
   // outcome is ok:true (200) or ok:false (400/403/404/500). Parse first,
@@ -83,7 +93,7 @@ export async function postMessageAsUser(
     );
   }
 
-  const parsed = responseSchema.safeParse(body);
+  const parsed = postMessageAsUserResultSchema.safeParse(body);
   if (!parsed.success) {
     // Most likely: 403 from `internalApiMiddleware` before reaching the
     // route handler, which returns `{ error: 'Forbidden' }`. Surface that
diff --git a/packages/kilo-chat/src/index.ts b/packages/kilo-chat/src/index.ts
index a55faa4199..c73e8819ba 100644
--- a/packages/kilo-chat/src/index.ts
+++ b/packages/kilo-chat/src/index.ts
@@ -21,5 +21,10 @@ export type { KiloChatEvent, KiloChatEventName, KiloChatEventOf } from './events
 export * from './schemas';
 export * from './webhook-schemas';
 export type * from './rpc-types';
+export {
+  postMessageAsUserOkSchema,
+  postMessageAsUserErrSchema,
+  postMessageAsUserResultSchema,
+} from './rpc-types';
 export * from './events';
 export * from './route-helpers';
diff --git a/packages/kilo-chat/src/rpc-types.ts b/packages/kilo-chat/src/rpc-types.ts
index 67c361c664..397ca2eb44 100644
--- a/packages/kilo-chat/src/rpc-types.ts
+++ b/packages/kilo-chat/src/rpc-types.ts
@@ -1,3 +1,5 @@
+import { z } from 'zod';
+
 // Cross-service RPC contracts exposed by the kilo-chat WorkerEntrypoint.
 //
 // Producer:  services/kilo-chat/src/index.ts (KiloChatService)
@@ -49,3 +51,25 @@ export type PostMessageAsUserErr = {
 };
 
 export type PostMessageAsUserResult = PostMessageAsUserOk | PostMessageAsUserErr;
+
+// Runtime schemas for the same shapes, so HTTP callers (e.g. cloud's
+// Next.js app) can Zod-validate responses against one source of truth
+// shared with the producer. Keep `z.infer` aligned with the types above —
+// if you add a field or error code here, mirror it in the type union.
+export const postMessageAsUserOkSchema = z.object({
+  ok: z.literal(true),
+  conversationId: z.string(),
+  messageId: z.string(),
+  conversationCreated: z.boolean(),
+});
+
+export const postMessageAsUserErrSchema = z.object({
+  ok: z.literal(false),
+  code: z.enum(['invalid_request', 'no_conversation', 'forbidden', 'internal']),
+  error: z.string(),
+});
+
+export const postMessageAsUserResultSchema = z.discriminatedUnion('ok', [
+  postMessageAsUserOkSchema,
+  postMessageAsUserErrSchema,
+]);

From b1ea1324a4da2bb4f775a8dc928d34d50a8f33e0 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 16:00:02 -0700
Subject: [PATCH 05/20] wip: installFromSource tRPC mutation + dispatch logic

---
 .../src/lib/kiloclaw/install-dispatch.test.ts | 206 ++++++++++++++++++
 apps/web/src/lib/kiloclaw/install-dispatch.ts | 145 ++++++++++++
 apps/web/src/lib/kiloclaw/install-sources.ts  |   9 +
 apps/web/src/routers/kiloclaw-router.ts       |  17 ++
 4 files changed, 377 insertions(+)
 create mode 100644 apps/web/src/lib/kiloclaw/install-dispatch.test.ts
 create mode 100644 apps/web/src/lib/kiloclaw/install-dispatch.ts

diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
new file mode 100644
index 0000000000..d857514ece
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -0,0 +1,206 @@
+import { TRPCError } from '@trpc/server';
+import { dispatchInstallFromSource } from './install-dispatch';
+import type { DispatchInstallFromSourceDeps } from './install-dispatch';
+import type { InstallPayload } from './install';
+import type { PostMessageAsUserResult } from '@kilocode/kilo-chat';
+
+const VALID_PAYLOAD: InstallPayload = {
+  slug: 'deep-research',
+  title: 'Source Hunter',
+  description: 'Deep research that finds primary sources.',
+  prompt: 'Research [topic] for me.',
+  signature: 'sig-base64',
+  signatureKeyId: 'kid-abc',
+  signedAt: '2026-05-28T00:00:00.000Z',
+  signatureVersion: 1,
+};
+
+const ACTIVE_INSTANCE = {
+  id: 'instance-1',
+  userId: 'user-1',
+  sandboxId: 'sb-1',
+} as unknown as Awaited<ReturnType<DispatchInstallFromSourceDeps['getActiveInstance']>>;
+
+function makeDeps(
+  overrides: Partial<{
+    fetchInstallPayload: DispatchInstallFromSourceDeps['fetchInstallPayload'];
+    getActiveInstance: DispatchInstallFromSourceDeps['getActiveInstance'];
+    postMessageAsUser: DispatchInstallFromSourceDeps['postMessageAsUser'];
+  }> = {}
+): DispatchInstallFromSourceDeps {
+  return {
+    fetchInstallPayload: overrides.fetchInstallPayload ?? (async () => VALID_PAYLOAD),
+    getActiveInstance: overrides.getActiveInstance ?? (async () => ACTIVE_INSTANCE),
+    postMessageAsUser:
+      overrides.postMessageAsUser ??
+      (async () =>
+        ({
+          ok: true,
+          conversationId: 'conv-1',
+          messageId: 'msg-1',
+          conversationCreated: false,
+        }) satisfies PostMessageAsUserResult),
+  };
+}
+
+const ARGS = { userId: 'user-1', source: 'byte' as const, slug: 'deep-research' };
+
+describe('dispatchInstallFromSource', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('happy path: fetches, looks up instance, dispatches, returns ok', async () => {
+    const fetchSpy = jest.fn(async () => VALID_PAYLOAD);
+    const instanceSpy = jest.fn(async () => ACTIVE_INSTANCE);
+    const dispatchSpy = jest.fn(
+      async () =>
+        ({
+          ok: true,
+          conversationId: 'conv-1',
+          messageId: 'msg-1',
+          conversationCreated: true,
+        }) satisfies PostMessageAsUserResult
+    );
+    const infoSpy = jest.spyOn(console, 'info').mockImplementation(() => {});
+
+    const result = await dispatchInstallFromSource(
+      ARGS,
+      makeDeps({
+        fetchInstallPayload: fetchSpy,
+        getActiveInstance: instanceSpy,
+        postMessageAsUser: dispatchSpy,
+      })
+    );
+
+    expect(result).toEqual({
+      ok: true,
+      conversationId: 'conv-1',
+      messageId: 'msg-1',
+      conversationCreated: true,
+    });
+
+    expect(fetchSpy).toHaveBeenCalledWith('byte', 'deep-research');
+    expect(instanceSpy).toHaveBeenCalledWith('user-1');
+    expect(dispatchSpy).toHaveBeenCalledWith({
+      userId: 'user-1',
+      sandboxId: 'sb-1',
+      message: 'Research [topic] for me.',
+      source: 'install',
+      autoCreateConversation: true,
+      correlation: { reason: 'clawbyte:deep-research' },
+    });
+
+    // Audit log emitted with the signing/dispatch fields.
+    expect(infoSpy).toHaveBeenCalledTimes(1);
+    const logged = JSON.parse(infoSpy.mock.calls[0]![0] as string);
+    expect(logged).toMatchObject({
+      event: 'install_dispatched',
+      userId: 'user-1',
+      source: 'byte',
+      slug: 'deep-research',
+      signatureKeyId: 'kid-abc',
+      signedAt: '2026-05-28T00:00:00.000Z',
+      conversationId: 'conv-1',
+      messageId: 'msg-1',
+      conversationCreated: true,
+    });
+    expect(logged.dispatchedAt).toEqual(expect.any(String));
+  });
+
+  it('throws NOT_FOUND when fetchInstallPayload returns null', async () => {
+    await expect(
+      dispatchInstallFromSource(ARGS, makeDeps({ fetchInstallPayload: async () => null }))
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+  });
+
+  it('returns no_instance (and does NOT dispatch) when user has no active instance', async () => {
+    const dispatchSpy = jest.fn();
+    const result = await dispatchInstallFromSource(
+      ARGS,
+      makeDeps({
+        getActiveInstance: async () => null,
+        postMessageAsUser: dispatchSpy as never,
+      })
+    );
+
+    expect(result).toEqual({ ok: false, code: 'no_instance' });
+    expect(dispatchSpy).not.toHaveBeenCalled();
+  });
+
+  it('maps kilo-chat no_conversation to typed no_instance result', async () => {
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const result = await dispatchInstallFromSource(
+      ARGS,
+      makeDeps({
+        postMessageAsUser: async () =>
+          ({
+            ok: false,
+            code: 'no_conversation',
+            error: 'user has no conversation',
+          }) satisfies PostMessageAsUserResult,
+      })
+    );
+    expect(result).toEqual({ ok: false, code: 'no_instance' });
+    expect(errSpy).toHaveBeenCalled();
+  });
+
+  it('throws INTERNAL_SERVER_ERROR on kilo-chat forbidden (auth misconfig)', async () => {
+    jest.spyOn(console, 'error').mockImplementation(() => {});
+    await expect(
+      dispatchInstallFromSource(
+        ARGS,
+        makeDeps({
+          postMessageAsUser: async () =>
+            ({ ok: false, code: 'forbidden', error: 'bad key' }) satisfies PostMessageAsUserResult,
+        })
+      )
+    ).rejects.toMatchObject({ code: 'INTERNAL_SERVER_ERROR' });
+  });
+
+  it('throws INTERNAL_SERVER_ERROR on kilo-chat internal/timeout error', async () => {
+    jest.spyOn(console, 'error').mockImplementation(() => {});
+    await expect(
+      dispatchInstallFromSource(
+        ARGS,
+        makeDeps({
+          postMessageAsUser: async () =>
+            ({
+              ok: false,
+              code: 'internal',
+              error: 'timed out',
+            }) satisfies PostMessageAsUserResult,
+        })
+      )
+    ).rejects.toMatchObject({ code: 'INTERNAL_SERVER_ERROR' });
+  });
+
+  it('throws INTERNAL_SERVER_ERROR on kilo-chat invalid_request', async () => {
+    jest.spyOn(console, 'error').mockImplementation(() => {});
+    await expect(
+      dispatchInstallFromSource(
+        ARGS,
+        makeDeps({
+          postMessageAsUser: async () =>
+            ({
+              ok: false,
+              code: 'invalid_request',
+              error: 'message empty',
+            }) satisfies PostMessageAsUserResult,
+        })
+      )
+    ).rejects.toMatchObject({ code: 'INTERNAL_SERVER_ERROR' });
+  });
+
+  it('rethrown TRPCError keeps the original code', async () => {
+    // Sanity check: we use TRPCError so callers can inspect .code.
+    let caught: TRPCError | undefined;
+    try {
+      await dispatchInstallFromSource(ARGS, makeDeps({ fetchInstallPayload: async () => null }));
+    } catch (err) {
+      caught = err as TRPCError;
+    }
+    expect(caught).toBeInstanceOf(TRPCError);
+    expect(caught?.code).toBe('NOT_FOUND');
+  });
+});
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
new file mode 100644
index 0000000000..791d840c3c
--- /dev/null
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -0,0 +1,145 @@
+import 'server-only';
+import { TRPCError } from '@trpc/server';
+import { fetchInstallPayload } from './install';
+import type { InstallSource } from './install-sources';
+import { getActiveInstance } from './instance-registry';
+import { postMessageAsUser } from './kilo-chat-internal-client';
+
+/**
+ * Server-side dispatch for the `installFromSource` tRPC mutation, extracted
+ * here so the decision logic is unit-testable without a full tRPC + DB
+ * setup. The mutation is a thin wrapper that supplies `userId` from
+ * `ctx.user.id`.
+ *
+ * Outcomes:
+ * - `{ ok: true, ... }` — payload verified, message dispatched to the user's
+ *   kiloclaw chat as their own user-turn. Client redirects to `/claw/chat`.
+ * - `{ ok: false, code: 'no_instance' }` — caller has no active kiloclaw
+ *   instance yet. Client should drop a `pending_install` cookie and
+ *   redirect to `/claw/new`; the chat page consumes the cookie after
+ *   provisioning completes.
+ *
+ * Other failure modes throw a `TRPCError`:
+ * - `NOT_FOUND` — byte missing upstream, signature failed, slug mismatch,
+ *   or verification config broken. Already logged in detail by
+ *   `fetchInstallPayload`; the throw is a one-liner for the client.
+ * - `INTERNAL_SERVER_ERROR` — kilo-chat returned `forbidden` (internal-auth
+ *   misconfigured) or `internal` (network/timeout/unknown). These should
+ *   page on-call; client gets a generic error.
+ */
+
+export type DispatchInstallFromSourceArgs = {
+  userId: string;
+  source: InstallSource;
+  slug: string;
+};
+
+export type DispatchInstallFromSourceResult =
+  | {
+      ok: true;
+      conversationId: string;
+      messageId: string;
+      conversationCreated: boolean;
+    }
+  | { ok: false; code: 'no_instance' };
+
+// Dependency injection points kept narrow for testing. Real callers always
+// use the production implementations.
+export type DispatchInstallFromSourceDeps = {
+  fetchInstallPayload: typeof fetchInstallPayload;
+  getActiveInstance: typeof getActiveInstance;
+  postMessageAsUser: typeof postMessageAsUser;
+};
+
+const defaultDeps: DispatchInstallFromSourceDeps = {
+  fetchInstallPayload,
+  getActiveInstance,
+  postMessageAsUser,
+};
+
+export async function dispatchInstallFromSource(
+  args: DispatchInstallFromSourceArgs,
+  deps: DispatchInstallFromSourceDeps = defaultDeps
+): Promise<DispatchInstallFromSourceResult> {
+  const { userId, source, slug } = args;
+
+  const payload = await deps.fetchInstallPayload(source, slug);
+  if (!payload) {
+    throw new TRPCError({
+      code: 'NOT_FOUND',
+      message: 'This install link is not available.',
+    });
+  }
+
+  const instance = await deps.getActiveInstance(userId);
+  if (!instance) {
+    // Don't dispatch yet — the user has no instance to deliver into. The
+    // client surfaces this as the "drop pending_install cookie + redirect
+    // to /claw/new" flow. Provisioning happens off the cookie; on chat-
+    // page load, the cookie triggers a re-call of this mutation.
+    return { ok: false, code: 'no_instance' };
+  }
+
+  const dispatchedAt = new Date().toISOString();
+  const result = await deps.postMessageAsUser({
+    userId,
+    sandboxId: instance.sandboxId,
+    message: payload.prompt,
+    source: 'install',
+    autoCreateConversation: true,
+    correlation: { reason: `clawbyte:${slug}` },
+  });
+
+  if (result.ok) {
+    // Audit log — durable storage is a separate open question; log-only
+    // for v1 so on-call can grep by these fields. The shape is intentionally
+    // flat-keyed JSON-stringified so it survives structured-log shipping.
+    console.info(
+      JSON.stringify({
+        event: 'install_dispatched',
+        userId,
+        source,
+        slug,
+        signatureKeyId: payload.signatureKeyId,
+        signedAt: payload.signedAt,
+        dispatchedAt,
+        conversationId: result.conversationId,
+        messageId: result.messageId,
+        conversationCreated: result.conversationCreated,
+      })
+    );
+    return {
+      ok: true,
+      conversationId: result.conversationId,
+      messageId: result.messageId,
+      conversationCreated: result.conversationCreated,
+    };
+  }
+
+  // result.ok === false: log loudly and throw. Each code is operationally
+  // distinct (auth bug vs. transient infra) so the log line carries enough
+  // to grep on.
+  console.error(
+    JSON.stringify({
+      event: 'install_dispatch_failed',
+      userId,
+      source,
+      slug,
+      signatureKeyId: payload.signatureKeyId,
+      kilochatCode: result.code,
+      kilochatError: result.error,
+    })
+  );
+
+  // `no_conversation` from kilo-chat would mean the instance exists but
+  // its chat hasn't been provisioned yet — same UX class as the
+  // no_instance case above, so map it to the typed result for consistency.
+  if (result.code === 'no_conversation') {
+    return { ok: false, code: 'no_instance' };
+  }
+
+  throw new TRPCError({
+    code: 'INTERNAL_SERVER_ERROR',
+    message: 'Could not install this byte. Please try again.',
+  });
+}
diff --git a/apps/web/src/lib/kiloclaw/install-sources.ts b/apps/web/src/lib/kiloclaw/install-sources.ts
index 08b50af35d..2dc2368ec1 100644
--- a/apps/web/src/lib/kiloclaw/install-sources.ts
+++ b/apps/web/src/lib/kiloclaw/install-sources.ts
@@ -9,6 +9,15 @@ export const INSTALL_SOURCES = {
 
 export type InstallSource = keyof typeof INSTALL_SOURCES;
 
+// Tuple of registered source keys for `z.enum(...)` input validation on the
+// `installFromSource` tRPC mutation. Derived from the registry so adding a
+// new source is a one-line change here, not two. The cast is sound at
+// runtime — INSTALL_SOURCES always has at least one entry.
+export const INSTALL_SOURCE_KEYS = Object.keys(INSTALL_SOURCES) as [
+  InstallSource,
+  ...InstallSource[],
+];
+
 export function isInstallSource(value: string): value is InstallSource {
   // Own-property check (not `value in`) so inherited names like `toString`
   // or `hasOwnProperty` can't pass the guard and then crash the lookup.
diff --git a/apps/web/src/routers/kiloclaw-router.ts b/apps/web/src/routers/kiloclaw-router.ts
index 24daca1c8b..4374218530 100644
--- a/apps/web/src/routers/kiloclaw-router.ts
+++ b/apps/web/src/routers/kiloclaw-router.ts
@@ -95,6 +95,8 @@ import {
   enqueueAffiliateEventForUser,
 } from '@/lib/impact/affiliate-events';
 import { clawAccessProcedure } from '@/lib/kiloclaw/access-gate';
+import { dispatchInstallFromSource } from '@/lib/kiloclaw/install-dispatch';
+import { INSTALL_SOURCE_KEYS } from '@/lib/kiloclaw/install-sources';
 import { cancelCliRun, createCliRun, getCliRunStatus } from '@/lib/kiloclaw/cli-runs';
 import { KILOCLAW_EARLYBIRD_EXPIRY_DATE } from '@/lib/kiloclaw/constants';
 import {
@@ -3030,6 +3032,21 @@ export const kiloclawRouter = createTRPCRouter({
     return instance ? { instanceId: instance.id } : null;
   }),
 
+  installFromSource: clawAccessProcedure
+    .input(
+      z.object({
+        source: z.enum(INSTALL_SOURCE_KEYS),
+        slug: z.string().min(1).max(200),
+      })
+    )
+    .mutation(async ({ ctx, input }) => {
+      return await dispatchInstallFromSource({
+        userId: ctx.user.id,
+        source: input.source,
+        slug: input.slug,
+      });
+    }),
+
   getMorningBriefingStatus: clawAccessProcedure.query(async ({ ctx }) => {
     const instance = await getActiveInstance(ctx.user.id);
     const client = new KiloClawInternalClient();

From 7ba4ada83e56941589a7187f0b496ef3c6fc2a89 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 16:38:31 -0700
Subject: [PATCH 06/20] fix(install): runtime sandbox id + shared params schema

---
 .../src/lib/kiloclaw/install-dispatch.test.ts | 66 +++++++++++++++++--
 apps/web/src/lib/kiloclaw/install-dispatch.ts | 45 ++++++++++++-
 packages/kilo-chat/src/index.ts               |  2 +
 packages/kilo-chat/src/rpc-types.ts           | 19 ++++++
 services/kilo-chat/src/routes/internal.ts     | 19 +-----
 5 files changed, 126 insertions(+), 25 deletions(-)

diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
index d857514ece..36640a27a6 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -21,16 +21,15 @@ const ACTIVE_INSTANCE = {
   sandboxId: 'sb-1',
 } as unknown as Awaited<ReturnType<DispatchInstallFromSourceDeps['getActiveInstance']>>;
 
+const RUNTIME_SANDBOX_ID = 'ki_runtime_sandbox';
+
 function makeDeps(
-  overrides: Partial<{
-    fetchInstallPayload: DispatchInstallFromSourceDeps['fetchInstallPayload'];
-    getActiveInstance: DispatchInstallFromSourceDeps['getActiveInstance'];
-    postMessageAsUser: DispatchInstallFromSourceDeps['postMessageAsUser'];
-  }> = {}
+  overrides: Partial<DispatchInstallFromSourceDeps> = {}
 ): DispatchInstallFromSourceDeps {
   return {
     fetchInstallPayload: overrides.fetchInstallPayload ?? (async () => VALID_PAYLOAD),
     getActiveInstance: overrides.getActiveInstance ?? (async () => ACTIVE_INSTANCE),
+    resolveRuntimeSandboxId: overrides.resolveRuntimeSandboxId ?? (async () => RUNTIME_SANDBOX_ID),
     postMessageAsUser:
       overrides.postMessageAsUser ??
       (async () =>
@@ -84,7 +83,7 @@ describe('dispatchInstallFromSource', () => {
     expect(instanceSpy).toHaveBeenCalledWith('user-1');
     expect(dispatchSpy).toHaveBeenCalledWith({
       userId: 'user-1',
-      sandboxId: 'sb-1',
+      sandboxId: RUNTIME_SANDBOX_ID, // NOT the registry row's sandboxId
       message: 'Research [topic] for me.',
       source: 'install',
       autoCreateConversation: true,
@@ -128,6 +127,61 @@ describe('dispatchInstallFromSource', () => {
     expect(dispatchSpy).not.toHaveBeenCalled();
   });
 
+  it('uses the runtime sandbox id, not the registry row, to dispatch', async () => {
+    jest.spyOn(console, 'info').mockImplementation(() => {});
+
+    // Make the registry row carry a legacy sandbox id; the resolver returns
+    // the modern ki_<instanceId> value the active worker/chat are keyed on.
+    const LEGACY_REGISTRY_SANDBOX = 'legacy_userbase64_sandbox';
+    const MODERN_RUNTIME_SANDBOX = 'ki_active_runtime_sandbox';
+    const halfMigratedInstance = {
+      ...ACTIVE_INSTANCE!,
+      sandboxId: LEGACY_REGISTRY_SANDBOX,
+    } as typeof ACTIVE_INSTANCE;
+
+    let dispatchedWith: Parameters<DispatchInstallFromSourceDeps['postMessageAsUser']>[0] | null =
+      null;
+    const dispatchSpy: DispatchInstallFromSourceDeps['postMessageAsUser'] = async params => {
+      dispatchedWith = params;
+      return {
+        ok: true,
+        conversationId: 'conv-x',
+        messageId: 'msg-x',
+        conversationCreated: false,
+      } satisfies PostMessageAsUserResult;
+    };
+
+    await dispatchInstallFromSource(
+      ARGS,
+      makeDeps({
+        getActiveInstance: async () => halfMigratedInstance,
+        resolveRuntimeSandboxId: async () => MODERN_RUNTIME_SANDBOX,
+        postMessageAsUser: dispatchSpy,
+      })
+    );
+
+    expect(dispatchedWith).not.toBeNull();
+    expect(dispatchedWith!.sandboxId).toBe(MODERN_RUNTIME_SANDBOX);
+    expect(dispatchedWith!.sandboxId).not.toBe(LEGACY_REGISTRY_SANDBOX);
+  });
+
+  it('returns no_instance when runtime sandbox id resolves to null', async () => {
+    // Instance row exists but the runtime status reports no sandbox yet
+    // (e.g. provisioning still warming up). Surface this as the same UX
+    // class as no-instance so the client lands on /claw/new and re-tries.
+    const dispatchSpy = jest.fn();
+    const result = await dispatchInstallFromSource(
+      ARGS,
+      makeDeps({
+        resolveRuntimeSandboxId: async () => null,
+        postMessageAsUser: dispatchSpy as never,
+      })
+    );
+
+    expect(result).toEqual({ ok: false, code: 'no_instance' });
+    expect(dispatchSpy).not.toHaveBeenCalled();
+  });
+
   it('maps kilo-chat no_conversation to typed no_instance result', async () => {
     const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
     const result = await dispatchInstallFromSource(
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index 791d840c3c..38043dfbfb 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -2,7 +2,12 @@ import 'server-only';
 import { TRPCError } from '@trpc/server';
 import { fetchInstallPayload } from './install';
 import type { InstallSource } from './install-sources';
-import { getActiveInstance } from './instance-registry';
+import {
+  getActiveInstance,
+  workerInstanceId,
+  type ActiveKiloClawInstance,
+} from './instance-registry';
+import { KiloClawInternalClient } from './kiloclaw-internal-client';
 import { postMessageAsUser } from './kilo-chat-internal-client';
 
 /**
@@ -48,12 +53,37 @@ export type DispatchInstallFromSourceResult =
 export type DispatchInstallFromSourceDeps = {
   fetchInstallPayload: typeof fetchInstallPayload;
   getActiveInstance: typeof getActiveInstance;
+  resolveRuntimeSandboxId: (
+    userId: string,
+    instance: ActiveKiloClawInstance
+  ) => Promise<string | null>;
   postMessageAsUser: typeof postMessageAsUser;
 };
 
+/**
+ * Resolve the *runtime* sandbox id the chat is currently keyed on, not the
+ * Postgres registry row's `sandbox_id`. Matches the dashboard/status path
+ * (`client.getStatus(userId, workerInstanceId(instance)).sandboxId`).
+ *
+ * Why this matters: during half-migrated states the registry row may still
+ * carry a legacy sandbox id while the active worker / chat are on
+ * `ki_<instanceId>`. Dispatching against the registry value in that state
+ * would write the install message into a stale conversation that the user
+ * never sees.
+ */
+async function defaultResolveRuntimeSandboxId(
+  userId: string,
+  instance: ActiveKiloClawInstance
+): Promise<string | null> {
+  const client = new KiloClawInternalClient();
+  const status = await client.getStatus(userId, workerInstanceId(instance));
+  return status.sandboxId ?? null;
+}
+
 const defaultDeps: DispatchInstallFromSourceDeps = {
   fetchInstallPayload,
   getActiveInstance,
+  resolveRuntimeSandboxId: defaultResolveRuntimeSandboxId,
   postMessageAsUser,
 };
 
@@ -80,10 +110,21 @@ export async function dispatchInstallFromSource(
     return { ok: false, code: 'no_instance' };
   }
 
+  // Use the runtime sandbox id (not the registry row's `sandboxId`) so
+  // half-migrated rows don't dispatch into a stale conversation. See
+  // `defaultResolveRuntimeSandboxId` for the why.
+  const runtimeSandboxId = await deps.resolveRuntimeSandboxId(userId, instance);
+  if (!runtimeSandboxId) {
+    // Instance row exists but the runtime isn't reporting a sandbox yet —
+    // provisioning still in flight. Same UX class as no-instance, so the
+    // client lands on /claw/new and re-tries once chat is ready.
+    return { ok: false, code: 'no_instance' };
+  }
+
   const dispatchedAt = new Date().toISOString();
   const result = await deps.postMessageAsUser({
     userId,
-    sandboxId: instance.sandboxId,
+    sandboxId: runtimeSandboxId,
     message: payload.prompt,
     source: 'install',
     autoCreateConversation: true,
diff --git a/packages/kilo-chat/src/index.ts b/packages/kilo-chat/src/index.ts
index c73e8819ba..f28b7466d8 100644
--- a/packages/kilo-chat/src/index.ts
+++ b/packages/kilo-chat/src/index.ts
@@ -25,6 +25,8 @@ export {
   postMessageAsUserOkSchema,
   postMessageAsUserErrSchema,
   postMessageAsUserResultSchema,
+  postMessageAsUserParamsSchema,
+  postMessageAsUserCorrelationSchema,
 } from './rpc-types';
 export * from './events';
 export * from './route-helpers';
diff --git a/packages/kilo-chat/src/rpc-types.ts b/packages/kilo-chat/src/rpc-types.ts
index 397ca2eb44..6f015b59af 100644
--- a/packages/kilo-chat/src/rpc-types.ts
+++ b/packages/kilo-chat/src/rpc-types.ts
@@ -52,6 +52,25 @@ export type PostMessageAsUserErr = {
 
 export type PostMessageAsUserResult = PostMessageAsUserOk | PostMessageAsUserErr;
 
+// Runtime schema for `PostMessageAsUserParams` so HTTP callers and the
+// HTTP route share one source of truth (Worker RPC callers rely on the
+// declared types). The bounds (`min(1)`, `max(64)` on source, etc.) are
+// HTTP-boundary safety and apply uniformly to both call paths.
+export const postMessageAsUserCorrelationSchema = z.object({
+  triggerId: z.string().max(200).optional(),
+  webhookRequestId: z.string().max(200).optional(),
+  reason: z.string().max(200).optional(),
+});
+
+export const postMessageAsUserParamsSchema = z.object({
+  userId: z.string().min(1).max(200),
+  sandboxId: z.string().min(1).max(200),
+  message: z.string().min(1),
+  source: z.string().min(1).max(64),
+  autoCreateConversation: z.boolean().optional(),
+  correlation: postMessageAsUserCorrelationSchema.optional(),
+});
+
 // Runtime schemas for the same shapes, so HTTP callers (e.g. cloud's
 // Next.js app) can Zod-validate responses against one source of truth
 // shared with the producer. Keep `z.infer` aligned with the types above —
diff --git a/services/kilo-chat/src/routes/internal.ts b/services/kilo-chat/src/routes/internal.ts
index 4d94498033..b2f4c06a3e 100644
--- a/services/kilo-chat/src/routes/internal.ts
+++ b/services/kilo-chat/src/routes/internal.ts
@@ -1,25 +1,10 @@
 import type { Hono } from 'hono';
 import type { ContentfulStatusCode } from 'hono/utils/http-status';
-import { z } from 'zod';
+import { postMessageAsUserParamsSchema } from '@kilocode/kilo-chat';
 import type { AuthContext } from '../auth';
 import { logger } from '../util/logger';
 import { postMessageAsUser } from '../services/post-message-as-user';
 
-const postMessageAsUserBodySchema = z.object({
-  userId: z.string().min(1),
-  sandboxId: z.string().min(1),
-  message: z.string().min(1),
-  source: z.string().min(1).max(64),
-  autoCreateConversation: z.boolean().optional(),
-  correlation: z
-    .object({
-      triggerId: z.string().optional(),
-      webhookRequestId: z.string().optional(),
-      reason: z.string().optional(),
-    })
-    .optional(),
-});
-
 /**
  * HTTP wrapper around the `postMessageAsUser` RPC primitive, for callers
  * that don't run on Cloudflare Workers (e.g. the Next.js cloud web app).
@@ -28,7 +13,7 @@ const postMessageAsUserBodySchema = z.object({
 export function registerInternalRoutes(app: Hono<{ Bindings: Env; Variables: AuthContext }>) {
   app.post('/internal/v1/post-message-as-user', async c => {
     const raw = await c.req.json().catch(() => null);
-    const parsed = postMessageAsUserBodySchema.safeParse(raw);
+    const parsed = postMessageAsUserParamsSchema.safeParse(raw);
     if (!parsed.success) {
       return c.json({ ok: false, code: 'invalid_request', error: parsed.error.message }, 400);
     }

From 800b86225ea164f2072a97b96726a20c90a284b3 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Thu, 28 May 2026 16:48:30 -0700
Subject: [PATCH 07/20] =?UTF-8?q?refactor(install):=20one-click=20install?=
 =?UTF-8?q?=20=E2=80=94=20server-component=20dispatch=20only=20the=20plan?=
 =?UTF-8?q?=20wandered,=20bring=20it=20back=20inline=20with=20version=201?=
 =?UTF-8?q?=20plan?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../install/[source]/[slug]/InstallClient.tsx | 46 ------------
 .../claw/install/[source]/[slug]/page.tsx     | 72 ++++++++++++++++---
 2 files changed, 62 insertions(+), 56 deletions(-)
 delete mode 100644 apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
deleted file mode 100644
index 904ffeb42b..0000000000
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ /dev/null
@@ -1,46 +0,0 @@
-'use client';
-
-import Link from 'next/link';
-import type { InstallPayload } from '@/lib/kiloclaw/install';
-import type { InstallSource } from '@/lib/kiloclaw/install-sources';
-
-type InstallClientProps = {
-  source: InstallSource;
-  sourceLabel: string;
-  payload: InstallPayload;
-};
-
-/**
- * Preview-only shell. The signed payload has been fetched and verified
- * server-side; this page shows the user what's about to be installed.
- * Dispatch is intentionally not wired yet — the install mutation lands
- * in the next slice on this branch and will replace the disabled CTA
- * below with a real click-to-install button. Until then, the route
- * deliberately does no install work; visiting it is safe.
- */
-export function InstallClient({ source, sourceLabel, payload }: InstallClientProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-xl flex-col items-center justify-center gap-4 px-6 py-12 text-center">
-      <p className="text-sm uppercase tracking-wide text-muted-foreground">{sourceLabel} preview</p>
-      <h1 className="text-2xl font-semibold">{payload.title}</h1>
-      {payload.tagline ? (
-        <p className="text-base text-muted-foreground">{payload.tagline}</p>
-      ) : null}
-      <p className="text-sm text-muted-foreground">{payload.description}</p>
-      <button
-        type="button"
-        disabled
-        className="mt-2 cursor-not-allowed rounded-md border border-muted px-4 py-2 text-sm text-muted-foreground opacity-60"
-        title="Install dispatch is being wired in the next change on this branch."
-      >
-        Install (coming soon)
-      </button>
-      <p className="text-xs text-muted-foreground">
-        Source: <code>{source}</code> · Slug: <code>{payload.slug}</code>
-      </p>
-      <Link href="/claw/chat" className="text-sm text-primary underline">
-        Cancel
-      </Link>
-    </div>
-  );
-}
diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
index b3febb0bad..8154b6aa95 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
@@ -1,21 +1,73 @@
-import { notFound } from 'next/navigation';
-import { fetchInstallPayload } from '@/lib/kiloclaw/install';
-import { INSTALL_SOURCES, isInstallSource } from '@/lib/kiloclaw/install-sources';
-import { InstallClient } from './InstallClient';
+import { cookies } from 'next/headers';
+import { notFound, redirect } from 'next/navigation';
+import { TRPCError } from '@trpc/server';
+import { getUserFromAuthOrRedirect } from '@/lib/user/server';
+import { requireKiloClawAccess } from '@/lib/kiloclaw/access-gate';
+import { dispatchInstallFromSource } from '@/lib/kiloclaw/install-dispatch';
+import { isInstallSource } from '@/lib/kiloclaw/install-sources';
 
 type InstallPageProps = {
   params: Promise<{ source: string; slug: string }>;
 };
 
+/**
+ * One-click install for a signed source payload (ClawByte today, more
+ * sources later). The user clicks "Try in KiloClaw" on kilo.ai, lands
+ * here, and the server dispatches the byte's prompt into their kiloclaw
+ * chat as a user-turn before redirecting to /claw/chat.
+ *
+ * No client component, no button, no second click — the install URL IS
+ * the click. If we ever want a "review the prompt before running it"
+ * gate, that lands on the chat/agent side later, not here.
+ *
+ * Auth + access:
+ * - Parent claw layout's getUserFromAuthOrRedirect bounces unauth users
+ *   to sign-in (pathname preserved by callbackPath, so they return
+ *   here after signing in).
+ * - requireKiloClawAccess throws TRPCError FORBIDDEN if the user has no
+ *   active KiloClaw subscription/trial.
+ *
+ * Outcomes:
+ * - Verified payload + active instance → as-user dispatch + redirect to
+ *   /claw/chat.
+ * - Verified payload + no instance yet → set pending_install cookie,
+ *   redirect to /claw/new so provisioning can run; the chat page
+ *   consumes the cookie once chat is ready.
+ * - Unknown source / unsigned byte / failed verification / slug mismatch
+ *   → notFound() (404). All cases logged in detail by the fetcher.
+ */
 export default async function InstallPage({ params }: InstallPageProps) {
   const { source, slug } = await params;
-
   if (!isInstallSource(source)) notFound();
 
-  const payload = await fetchInstallPayload(source, slug);
-  if (!payload) notFound();
+  const user = await getUserFromAuthOrRedirect();
+  await requireKiloClawAccess(user.id);
+
+  let result: Awaited<ReturnType<typeof dispatchInstallFromSource>>;
+  try {
+    result = await dispatchInstallFromSource({ userId: user.id, source, slug });
+  } catch (err) {
+    if (err instanceof TRPCError && err.code === 'NOT_FOUND') notFound();
+    // Let everything else bubble to Next.js's error boundary so we don't
+    // mask a real misconfiguration as a missing byte.
+    throw err;
+  }
+
+  if (result.ok) {
+    redirect('/claw/chat');
+  }
 
-  return (
-    <InstallClient source={source} sourceLabel={INSTALL_SOURCES[source].label} payload={payload} />
-  );
+  // result.ok === false, code === 'no_instance' — the user is entitled to
+  // install but hasn't provisioned a kiloclaw yet (or the runtime sandbox
+  // isn't reporting yet). Stash the install intent in a cookie and send
+  // them through provisioning; the chat page picks it up afterwards.
+  const cookieStore = await cookies();
+  cookieStore.set('pending_install', JSON.stringify({ source, slug }), {
+    path: '/claw',
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    maxAge: 60 * 60, // 1h — generous enough for provisioning, short
+    // enough that a stale cookie isn't redispatched days later.
+  });
+  redirect('/claw/new');
 }

From 98398959d876d3670cb1252ae3bba36320bb7c3f Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 10:55:20 -0700
Subject: [PATCH 08/20] wip(install): preview + explicit-POST install flow,
 SSRF hardening

---
 .../install/[source]/[slug]/InstallClient.tsx | 91 +++++++++++++++++++
 .../claw/install/[source]/[slug]/page.tsx     | 81 +++++++----------
 apps/web/src/lib/kiloclaw/install-dispatch.ts |  8 +-
 apps/web/src/lib/kiloclaw/install.test.ts     | 25 ++++-
 apps/web/src/lib/kiloclaw/install.ts          | 34 ++++++-
 5 files changed, 185 insertions(+), 54 deletions(-)
 create mode 100644 apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
new file mode 100644
index 0000000000..b9f9dbbfa1
--- /dev/null
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -0,0 +1,91 @@
+'use client';
+
+import { useState } from 'react';
+import Link from 'next/link';
+import { useRouter } from 'next/navigation';
+import { useMutation } from '@tanstack/react-query';
+import { Loader2 } from 'lucide-react';
+import { toast } from 'sonner';
+import { TRPCClientError } from '@trpc/client';
+import { useTRPC } from '@/lib/trpc/utils';
+import { Button } from '@/components/ui/button';
+import type { InstallPayload } from '@/lib/kiloclaw/install';
+import type { InstallSource } from '@/lib/kiloclaw/install-sources';
+
+type InstallClientProps = {
+  source: InstallSource;
+  sourceLabel: string;
+  payload: InstallPayload;
+};
+
+/**
+ * Install preview + explicit dispatch. The signed payload was fetched and
+ * verified server-side (and paid-access gated) in `page.tsx`; this shows the
+ * user what's about to be installed.
+ *
+ * Dispatch happens ONLY on an explicit Install click, which fires the
+ * `installFromSource` POST mutation — never on GET render. A cross-site POST
+ * can't carry the SameSite session cookie, so this closes the CSRF /
+ * lure-a-click class that a GET-dispatch route would re-open.
+ */
+export function InstallClient({ source, sourceLabel, payload }: InstallClientProps) {
+  const router = useRouter();
+  const trpc = useTRPC();
+  // `navigating` keeps the button disabled through the post-success redirect
+  // so a double-click can't fire a second dispatch while the route changes.
+  const [navigating, setNavigating] = useState(false);
+  const install = useMutation(trpc.kiloclaw.installFromSource.mutationOptions());
+
+  async function onInstall() {
+    try {
+      const result = await install.mutateAsync({ source, slug: payload.slug });
+      setNavigating(true);
+      if (result.ok) {
+        router.push('/claw/chat');
+        return;
+      }
+      // No active instance yet — remember the install intent and route through
+      // provisioning. The chat page consumes `pending_install` once the
+      // instance is ready (separate slice). Cookie is intentionally not
+      // httpOnly so the client-side consumer can read + clear it.
+      setPendingInstallCookie(source, payload.slug);
+      router.push('/claw/new');
+    } catch (err) {
+      const message =
+        err instanceof TRPCClientError && err.data?.code === 'NOT_FOUND'
+          ? 'This install link is no longer available.'
+          : 'Could not install this byte. Please try again.';
+      toast.error(message);
+    }
+  }
+
+  const busy = install.isPending || navigating;
+
+  return (
+    <div className="mx-auto flex min-h-[60vh] max-w-xl flex-col items-center justify-center gap-4 px-6 py-12 text-center">
+      <p className="text-muted-foreground text-sm tracking-wide uppercase">{sourceLabel}</p>
+      <h1 className="text-2xl font-semibold">{payload.title}</h1>
+      {payload.tagline ? (
+        <p className="text-muted-foreground text-base">{payload.tagline}</p>
+      ) : null}
+      <p className="text-muted-foreground text-sm">{payload.description}</p>
+      <Button type="button" onClick={onInstall} disabled={busy} className="mt-2">
+        {busy ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
+        {busy ? 'Installing…' : 'Install'}
+      </Button>
+      <Link href="/claw/chat" className="text-muted-foreground text-sm underline">
+        Cancel
+      </Link>
+    </div>
+  );
+}
+
+/**
+ * Short-lived intent cookie read by the chat page after provisioning. Mirrors
+ * the attributes the old route handler used (path=/claw, SameSite=Lax, 1h).
+ */
+function setPendingInstallCookie(source: string, slug: string) {
+  const value = encodeURIComponent(JSON.stringify({ source, slug }));
+  const secure = window.location.protocol === 'https:' ? '; secure' : '';
+  document.cookie = `pending_install=${value}; path=/claw; max-age=3600; samesite=lax${secure}`;
+}
diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
index 8154b6aa95..937b5f8035 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
@@ -1,73 +1,60 @@
-import { cookies } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
 import { TRPCError } from '@trpc/server';
 import { getUserFromAuthOrRedirect } from '@/lib/user/server';
 import { requireKiloClawAccess } from '@/lib/kiloclaw/access-gate';
-import { dispatchInstallFromSource } from '@/lib/kiloclaw/install-dispatch';
-import { isInstallSource } from '@/lib/kiloclaw/install-sources';
+import { fetchInstallPayload } from '@/lib/kiloclaw/install';
+import { INSTALL_SOURCES, isInstallSource } from '@/lib/kiloclaw/install-sources';
+import { InstallClient } from './InstallClient';
 
 type InstallPageProps = {
   params: Promise<{ source: string; slug: string }>;
 };
 
 /**
- * One-click install for a signed source payload (ClawByte today, more
- * sources later). The user clicks "Try in KiloClaw" on kilo.ai, lands
- * here, and the server dispatches the byte's prompt into their kiloclaw
- * chat as a user-turn before redirecting to /claw/chat.
+ * One-click install preview for a signed source payload (ClawByte today,
+ * more sources later). Rendered as a Server Component — loading this page
+ * does NO install work. The actual chat dispatch happens only on an explicit
+ * Install click in `InstallClient`, which fires the `installFromSource` POST
+ * mutation. That split is load-bearing: a GET must never dispatch, or a
+ * third-party page could pop a prompt into a user's chat just by getting
+ * them to load the URL (CSRF / lure-a-click).
  *
- * No client component, no button, no second click — the install URL IS
- * the click. If we ever want a "review the prompt before running it"
- * gate, that lands on the chat/agent side later, not here.
+ * Gating, in order:
+ * 1. Auth — the parent claw layout (`getUserFromAuthOrRedirect`) bounces
+ *    unauth users to sign-in; `callbackPath` preserves this pathname so they
+ *    return here after signing in. We call it again to get the user id.
+ * 2. Active paid access — fetching + verifying the signed byte is paid-user
+ *    compute (outbound HTTP + Ed25519 verify). A logged-in user without an
+ *    active subscription/trial must NOT be able to trigger it, so we gate
+ *    before the fetch and route no-access users into the subscribe/provision
+ *    funnel (`/claw/new`) instead of pulling the byte.
+ * 3. Payload fetch + verify — only after the access gate passes.
  *
- * Auth + access:
- * - Parent claw layout's getUserFromAuthOrRedirect bounces unauth users
- *   to sign-in (pathname preserved by callbackPath, so they return
- *   here after signing in).
- * - requireKiloClawAccess throws TRPCError FORBIDDEN if the user has no
- *   active KiloClaw subscription/trial.
- *
- * Outcomes:
- * - Verified payload + active instance → as-user dispatch + redirect to
- *   /claw/chat.
- * - Verified payload + no instance yet → set pending_install cookie,
- *   redirect to /claw/new so provisioning can run; the chat page
- *   consumes the cookie once chat is ready.
- * - Unknown source / unsigned byte / failed verification / slug mismatch
- *   → notFound() (404). All cases logged in detail by the fetcher.
+ * Unknown source / unsigned byte / failed verification / slug mismatch →
+ * `notFound()` (404). All cases logged in detail by `fetchInstallPayload`.
  */
 export default async function InstallPage({ params }: InstallPageProps) {
   const { source, slug } = await params;
   if (!isInstallSource(source)) notFound();
 
   const user = await getUserFromAuthOrRedirect();
-  await requireKiloClawAccess(user.id);
 
-  let result: Awaited<ReturnType<typeof dispatchInstallFromSource>>;
   try {
-    result = await dispatchInstallFromSource({ userId: user.id, source, slug });
+    await requireKiloClawAccess(user.id);
   } catch (err) {
-    if (err instanceof TRPCError && err.code === 'NOT_FOUND') notFound();
-    // Let everything else bubble to Next.js's error boundary so we don't
-    // mask a real misconfiguration as a missing byte.
+    // No active subscription/trial → don't pull the byte. Send them into the
+    // provisioning/subscribe flow. (Preserving the install intent across that
+    // flow lands with the `pending_install` cookie consumer slice.)
+    if (err instanceof TRPCError && err.code === 'FORBIDDEN') {
+      redirect('/claw/new');
+    }
     throw err;
   }
 
-  if (result.ok) {
-    redirect('/claw/chat');
-  }
+  const payload = await fetchInstallPayload(source, slug);
+  if (!payload) notFound();
 
-  // result.ok === false, code === 'no_instance' — the user is entitled to
-  // install but hasn't provisioned a kiloclaw yet (or the runtime sandbox
-  // isn't reporting yet). Stash the install intent in a cookie and send
-  // them through provisioning; the chat page picks it up afterwards.
-  const cookieStore = await cookies();
-  cookieStore.set('pending_install', JSON.stringify({ source, slug }), {
-    path: '/claw',
-    sameSite: 'lax',
-    secure: process.env.NODE_ENV === 'production',
-    maxAge: 60 * 60, // 1h — generous enough for provisioning, short
-    // enough that a stale cookie isn't redispatched days later.
-  });
-  redirect('/claw/new');
+  return (
+    <InstallClient source={source} sourceLabel={INSTALL_SOURCES[source].label} payload={payload} />
+  );
 }
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index 38043dfbfb..bfaab614a0 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -122,13 +122,19 @@ export async function dispatchInstallFromSource(
   }
 
   const dispatchedAt = new Date().toISOString();
+  // Correlation.reason is capped at 200 chars in the shared schema. Install
+  // slugs are accepted up to 200, so `clawbyte:${slug}` can exceed 200 and
+  // get rejected as invalid_request. Truncate the audit field rather than
+  // bouncing an otherwise-valid install; the slug also appears verbatim in
+  // the install_dispatched log line below.
+  const reason = `clawbyte:${slug}`.slice(0, 200);
   const result = await deps.postMessageAsUser({
     userId,
     sandboxId: runtimeSandboxId,
     message: payload.prompt,
     source: 'install',
     autoCreateConversation: true,
-    correlation: { reason: `clawbyte:${slug}` },
+    correlation: { reason },
   });
 
   if (result.ok) {
diff --git a/apps/web/src/lib/kiloclaw/install.test.ts b/apps/web/src/lib/kiloclaw/install.test.ts
index 5b47b689aa..6e838804f2 100644
--- a/apps/web/src/lib/kiloclaw/install.test.ts
+++ b/apps/web/src/lib/kiloclaw/install.test.ts
@@ -3,7 +3,6 @@ import crypto from 'node:crypto';
 // Generate a real Ed25519 keypair once for the whole test file. Tests sign
 // fixtures with the private half and pin the public half via env var.
 const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');
-const PRIVATE_PEM = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
 const PUBLIC_PEM = publicKey.export({ type: 'spki', format: 'pem' }) as string;
 
 // Derive the matching kid the way the signer / verifier do.
@@ -98,6 +97,18 @@ describe('fetchInstallPayload', () => {
     await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow(/500/);
   });
 
+  it('rejects (does not follow) a redirect from the upstream origin (SSRF)', async () => {
+    // With `redirect: 'error'`, the platform fetch rejects rather than
+    // following a 3xx — so a compromised/abused trusted origin can't bounce
+    // the fetch to an attacker host. Simulate that rejection.
+    jest
+      .spyOn(global, 'fetch')
+      .mockRejectedValue(new TypeError('fetch failed: redirect mode is set to error'));
+    await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow(
+      /redirects are not followed/
+    );
+  });
+
   it('rejects payload signed by a different key (kid mismatch)', async () => {
     const { privateKey: foreignPriv, publicKey: foreignPub } =
       crypto.generateKeyPairSync('ed25519');
@@ -173,9 +184,17 @@ describe('fetchInstallPayload', () => {
     expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('in the future'));
   });
 
-  it('rejects an unsigned payload via Zod parse', async () => {
+  it('returns null and logs on an unsigned (Zod-invalid) payload', async () => {
+    // Treat schema-mismatched upstream responses as "unavailable" rather
+    // than throwing — matches the "byte not found" UX so the page can
+    // hand a single notFound() to the user.
     jest.spyOn(global, 'fetch').mockResolvedValue(jsonResponse(VALID_BASE));
-    await expect(fetchInstallPayload('byte', 'deep-research')).rejects.toThrow();
+    const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await fetchInstallPayload('byte', 'deep-research');
+
+    expect(result).toBeNull();
+    expect(errSpy).toHaveBeenCalledWith(expect.stringContaining('invalid upstream payload'));
   });
 
   it('rejects when signed payload.slug does not match the requested slug', async () => {
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
index 593d6b6d8e..5b3fa6bccc 100644
--- a/apps/web/src/lib/kiloclaw/install.ts
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -1,5 +1,6 @@
 import crypto from 'node:crypto';
 import { z } from 'zod';
+import { MESSAGE_TEXT_MAX_CHARS } from '@kilocode/kilo-chat';
 import { INSTALL_SOURCES, type InstallSource } from './install-sources';
 
 /**
@@ -30,7 +31,10 @@ const installPayloadSchema = z.object({
   slug: z.string().min(1).max(200),
   title: z.string().max(500),
   description: z.string().max(2000),
-  prompt: z.string().min(1).max(32000),
+  // Cap matches `MESSAGE_TEXT_MAX_CHARS` in @kilocode/kilo-chat so a valid
+  // signed payload can't pass install verification only to fail downstream
+  // as `invalid_request` when kilo-chat enforces its per-text-block limit.
+  prompt: z.string().min(1).max(MESSAGE_TEXT_MAX_CHARS),
   tagline: z.string().max(500).optional(),
   category: z.string().max(100).optional(),
   tags: z.array(z.string().max(100)).max(50).optional(),
@@ -166,7 +170,20 @@ export async function fetchInstallPayload(
   slug: string
 ): Promise<InstallPayload | null> {
   const url = INSTALL_SOURCES[source].urlTemplate.replace('{slug}', encodeURIComponent(slug));
-  const res = await fetch(url, { next: { revalidate: 300 } });
+  // `redirect: 'error'` is SSRF defense-in-depth: the host comes from the
+  // registry (not user input) and the slug is encoded into a single path
+  // segment, so a request can't target an off-registry origin directly. The
+  // one residual path would be the trusted origin itself answering 3xx →
+  // attacker host; refusing to follow redirects closes that before the
+  // signature check even runs. A redirect now rejects (caught below).
+  let res: Response;
+  try {
+    res = await fetch(url, { next: { revalidate: 300 }, redirect: 'error' });
+  } catch (err) {
+    throw new Error(
+      `fetchInstallPayload(${source}, ${slug}): request failed (redirects are not followed): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -202,7 +219,18 @@ export async function fetchInstallPayload(
       `fetchInstallPayload(${source}, ${slug}): upstream returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const payload = installPayloadSchema.parse(json);
+  // safeParse rather than parse: an unsigned, malformed, or
+  // rollout-mismatched upstream payload must not throw a 500 — collapse
+  // it into the same null-return path as "not found" so the page surfaces
+  // a controlled `notFound()`.
+  const parsed = installPayloadSchema.safeParse(json);
+  if (!parsed.success) {
+    console.error(
+      `[install] invalid upstream payload for ${source}/${slug}: ${parsed.error.message}`
+    );
+    return null;
+  }
+  const payload = parsed.data;
 
   const verify = verifySignedPayload(payload);
   if (!verify.ok) {

From 8ed73a2be700b16f928f16744784767b39f45b23 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 11:19:55 -0700
Subject: [PATCH 09/20] =?UTF-8?q?fix(install):=20address=20local=20review?=
 =?UTF-8?q?=20=E2=80=94=20sign-only=20payload=20+=20schema=20source-of-tru?=
 =?UTF-8?q?th?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../install/[source]/[slug]/InstallClient.tsx |  3 -
 apps/web/src/lib/kiloclaw/install.test.ts     |  3 -
 apps/web/src/lib/kiloclaw/install.ts          | 11 +++-
 packages/kilo-chat/src/rpc-types.ts           | 62 ++++++-------------
 4 files changed, 27 insertions(+), 52 deletions(-)

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
index b9f9dbbfa1..ca50bec16f 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -65,9 +65,6 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
     <div className="mx-auto flex min-h-[60vh] max-w-xl flex-col items-center justify-center gap-4 px-6 py-12 text-center">
       <p className="text-muted-foreground text-sm tracking-wide uppercase">{sourceLabel}</p>
       <h1 className="text-2xl font-semibold">{payload.title}</h1>
-      {payload.tagline ? (
-        <p className="text-muted-foreground text-base">{payload.tagline}</p>
-      ) : null}
       <p className="text-muted-foreground text-sm">{payload.description}</p>
       <Button type="button" onClick={onInstall} disabled={busy} className="mt-2">
         {busy ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
diff --git a/apps/web/src/lib/kiloclaw/install.test.ts b/apps/web/src/lib/kiloclaw/install.test.ts
index 6e838804f2..b742ede9e3 100644
--- a/apps/web/src/lib/kiloclaw/install.test.ts
+++ b/apps/web/src/lib/kiloclaw/install.test.ts
@@ -25,9 +25,6 @@ type RawPayload = {
   title: string;
   description: string;
   prompt: string;
-  tagline?: string;
-  category?: string;
-  tags?: string[];
   signature?: string;
   signatureKeyId?: string;
   signedAt?: string;
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
index 5b3fa6bccc..77e9d79d8d 100644
--- a/apps/web/src/lib/kiloclaw/install.ts
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -27,6 +27,14 @@ const MAX_SIGNATURE_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 // serverless render.
 const MAX_RESPONSE_BYTES = 256 * 1024;
 
+// IMPORTANT: this schema intentionally contains ONLY fields that are covered
+// by the Ed25519 signature (slug/title/description/prompt — see
+// `canonicalEnvelopeString`) plus the signature metadata itself. Marketing-
+// only fields the signer leaves unsigned (tagline, category, tags, body,
+// ratings, …) are deliberately NOT modelled here: Zod strips them on parse,
+// so it is impossible to render unsigned, tamperable content in the install
+// preview. Do not add an unsigned field here without also adding it to the
+// signed envelope on both the signer (kilocode-landing) and the verifier.
 const installPayloadSchema = z.object({
   slug: z.string().min(1).max(200),
   title: z.string().max(500),
@@ -35,9 +43,6 @@ const installPayloadSchema = z.object({
   // signed payload can't pass install verification only to fail downstream
   // as `invalid_request` when kilo-chat enforces its per-text-block limit.
   prompt: z.string().min(1).max(MESSAGE_TEXT_MAX_CHARS),
-  tagline: z.string().max(500).optional(),
-  category: z.string().max(100).optional(),
-  tags: z.array(z.string().max(100)).max(50).optional(),
   // Signature fields. All four are required — an unsigned payload fails
   // Zod parsing before reaching the crypto verify step.
   signature: z.string().min(1).max(200), // base64 Ed25519 sig (~88 chars)
diff --git a/packages/kilo-chat/src/rpc-types.ts b/packages/kilo-chat/src/rpc-types.ts
index 6f015b59af..17fa6f3ffb 100644
--- a/packages/kilo-chat/src/rpc-types.ts
+++ b/packages/kilo-chat/src/rpc-types.ts
@@ -16,46 +16,15 @@ import { z } from 'zod';
 // build.
 
 // ── postMessageAsUser ──────────────────────────────────────────────
+//
+// The Zod schemas are the single source of truth; the exported TS types are
+// derived from them via `z.infer`. Worker RPC callers import the types (which
+// compile away — `z.infer` is type-only, no runtime cost), while HTTP callers
+// and the HTTP route reuse the schemas for validation. Add a field or error
+// code in one place and both call paths stay in sync by construction. The
+// bounds (`min(1)`, `max(64)` on source, etc.) are HTTP-boundary safety and
+// apply uniformly to both call paths.
 
-export type PostMessageAsUserCorrelation = {
-  triggerId?: string;
-  webhookRequestId?: string;
-  reason?: string;
-};
-
-export type PostMessageAsUserParams = {
-  userId: string;
-  sandboxId: string;
-  message: string;
-  // Origin identifier for diagnostics (e.g. "webhook", "onboarding-warmup").
-  // Logged so structured-log queries can attribute new conversations to a
-  // specific source.
-  source: string;
-  // Default true. Pass false to fail the call if the user has never opened
-  // a chat with this bot.
-  autoCreateConversation?: boolean;
-  correlation?: PostMessageAsUserCorrelation;
-};
-
-export type PostMessageAsUserOk = {
-  ok: true;
-  conversationId: string;
-  messageId: string;
-  conversationCreated: boolean;
-};
-
-export type PostMessageAsUserErr = {
-  ok: false;
-  code: 'invalid_request' | 'no_conversation' | 'forbidden' | 'internal';
-  error: string;
-};
-
-export type PostMessageAsUserResult = PostMessageAsUserOk | PostMessageAsUserErr;
-
-// Runtime schema for `PostMessageAsUserParams` so HTTP callers and the
-// HTTP route share one source of truth (Worker RPC callers rely on the
-// declared types). The bounds (`min(1)`, `max(64)` on source, etc.) are
-// HTTP-boundary safety and apply uniformly to both call paths.
 export const postMessageAsUserCorrelationSchema = z.object({
   triggerId: z.string().max(200).optional(),
   webhookRequestId: z.string().max(200).optional(),
@@ -66,15 +35,16 @@ export const postMessageAsUserParamsSchema = z.object({
   userId: z.string().min(1).max(200),
   sandboxId: z.string().min(1).max(200),
   message: z.string().min(1),
+  // Origin identifier for diagnostics (e.g. "webhook", "onboarding-warmup").
+  // Logged so structured-log queries can attribute new conversations to a
+  // specific source.
   source: z.string().min(1).max(64),
+  // Default true. Pass false to fail the call if the user has never opened
+  // a chat with this bot.
   autoCreateConversation: z.boolean().optional(),
   correlation: postMessageAsUserCorrelationSchema.optional(),
 });
 
-// Runtime schemas for the same shapes, so HTTP callers (e.g. cloud's
-// Next.js app) can Zod-validate responses against one source of truth
-// shared with the producer. Keep `z.infer` aligned with the types above —
-// if you add a field or error code here, mirror it in the type union.
 export const postMessageAsUserOkSchema = z.object({
   ok: z.literal(true),
   conversationId: z.string(),
@@ -92,3 +62,9 @@ export const postMessageAsUserResultSchema = z.discriminatedUnion('ok', [
   postMessageAsUserOkSchema,
   postMessageAsUserErrSchema,
 ]);
+
+export type PostMessageAsUserCorrelation = z.infer<typeof postMessageAsUserCorrelationSchema>;
+export type PostMessageAsUserParams = z.infer<typeof postMessageAsUserParamsSchema>;
+export type PostMessageAsUserOk = z.infer<typeof postMessageAsUserOkSchema>;
+export type PostMessageAsUserErr = z.infer<typeof postMessageAsUserErrSchema>;
+export type PostMessageAsUserResult = z.infer<typeof postMessageAsUserResultSchema>;

From 795f71b8ecb7d97c3b655b476c416a0a736f2658 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 11:44:02 -0700
Subject: [PATCH 10/20] refactor(install): drop cross-funnel intent persistence

---
 .../install/[source]/[slug]/InstallClient.tsx | 19 ++++---------------
 .../claw/install/[source]/[slug]/page.tsx     |  7 ++++---
 apps/web/src/lib/kiloclaw/install-dispatch.ts | 11 +++++------
 3 files changed, 13 insertions(+), 24 deletions(-)

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
index ca50bec16f..036029f07d 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -44,11 +44,10 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
         router.push('/claw/chat');
         return;
       }
-      // No active instance yet — remember the install intent and route through
-      // provisioning. The chat page consumes `pending_install` once the
-      // instance is ready (separate slice). Cookie is intentionally not
-      // httpOnly so the client-side consumer can read + clear it.
-      setPendingInstallCookie(source, payload.slug);
+      // No active instance yet — send them to set one up. We intentionally do
+      // NOT persist the install intent across the (long, multi-step) onboarding
+      // flow; the user finishes setup, then installs again from the byte page.
+      // Re-running the install link is cheap and predictable.
       router.push('/claw/new');
     } catch (err) {
       const message =
@@ -76,13 +75,3 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
     </div>
   );
 }
-
-/**
- * Short-lived intent cookie read by the chat page after provisioning. Mirrors
- * the attributes the old route handler used (path=/claw, SameSite=Lax, 1h).
- */
-function setPendingInstallCookie(source: string, slug: string) {
-  const value = encodeURIComponent(JSON.stringify({ source, slug }));
-  const secure = window.location.protocol === 'https:' ? '; secure' : '';
-  document.cookie = `pending_install=${value}; path=/claw; max-age=3600; samesite=lax${secure}`;
-}
diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
index 937b5f8035..58c8bdb34a 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/page.tsx
@@ -42,9 +42,10 @@ export default async function InstallPage({ params }: InstallPageProps) {
   try {
     await requireKiloClawAccess(user.id);
   } catch (err) {
-    // No active subscription/trial → don't pull the byte. Send them into the
-    // provisioning/subscribe flow. (Preserving the install intent across that
-    // flow lands with the `pending_install` cookie consumer slice.)
+    // No active subscription/trial → don't pull the byte. Send them to the
+    // subscribe/provision flow (which presents the marketing/sign-up page).
+    // We intentionally don't persist install intent across that flow; the user
+    // installs again from the byte page once they're set up.
     if (err instanceof TRPCError && err.code === 'FORBIDDEN') {
       redirect('/claw/new');
     }
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index bfaab614a0..c92a4c6c93 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -20,9 +20,9 @@ import { postMessageAsUser } from './kilo-chat-internal-client';
  * - `{ ok: true, ... }` — payload verified, message dispatched to the user's
  *   kiloclaw chat as their own user-turn. Client redirects to `/claw/chat`.
  * - `{ ok: false, code: 'no_instance' }` — caller has no active kiloclaw
- *   instance yet. Client should drop a `pending_install` cookie and
- *   redirect to `/claw/new`; the chat page consumes the cookie after
- *   provisioning completes.
+ *   instance yet. Client redirects to `/claw/new` to provision; the install
+ *   intent is not persisted across that flow (the user re-installs from the
+ *   byte page once set up).
  *
  * Other failure modes throw a `TRPCError`:
  * - `NOT_FOUND` — byte missing upstream, signature failed, slug mismatch,
@@ -104,9 +104,8 @@ export async function dispatchInstallFromSource(
   const instance = await deps.getActiveInstance(userId);
   if (!instance) {
     // Don't dispatch yet — the user has no instance to deliver into. The
-    // client surfaces this as the "drop pending_install cookie + redirect
-    // to /claw/new" flow. Provisioning happens off the cookie; on chat-
-    // page load, the cookie triggers a re-call of this mutation.
+    // client redirects them to `/claw/new` to provision; they re-install
+    // from the byte page afterward (intent is intentionally not persisted).
     return { ok: false, code: 'no_instance' };
   }
 

From cd0515f4b38e479e0d0bd4747b687b3d4f68f343 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 12:06:18 -0700
Subject: [PATCH 11/20] add tests

---
 apps/web/src/routers/kiloclaw-router.test.ts | 116 +++++++++++++++++++
 1 file changed, 116 insertions(+)

diff --git a/apps/web/src/routers/kiloclaw-router.test.ts b/apps/web/src/routers/kiloclaw-router.test.ts
index 8883efec56..0ea3537a71 100644
--- a/apps/web/src/routers/kiloclaw-router.test.ts
+++ b/apps/web/src/routers/kiloclaw-router.test.ts
@@ -132,6 +132,14 @@ jest.mock('@/lib/kiloclaw/kiloclaw-internal-client', () => {
   };
 });
 
+// Mock the install dispatch lib so installFromSource tests exercise the
+// procedure (auth gate + input validation + wiring) without the real
+// fetch/verify/kilo-chat path (covered by install-dispatch.test.ts).
+jest.mock('@/lib/kiloclaw/install-dispatch', () => {
+  const dispatchInstallFromSource = jest.fn();
+  return { dispatchInstallFromSource, __dispatchInstallFromSource: dispatchInstallFromSource };
+});
+
 let createCaller: (ctx: { user: Awaited<ReturnType<typeof insertTestUser>> }) => {
   getStatus: () => Promise<unknown>;
   getNavState: () => Promise<{ hasActiveInstance: boolean }>;
@@ -202,6 +210,16 @@ let createCaller: (ctx: { user: Awaited<ReturnType<typeof insertTestUser>> }) =>
       pendingRewardCount: number;
     };
   }>;
+  // Method syntax (bivariant params) so the real caller's narrower
+  // `source: 'byte'` input stays assignable while tests can pass an arbitrary
+  // string for the input-validation case.
+  installFromSource(input: {
+    source: string;
+    slug: string;
+  }): Promise<
+    | { ok: true; conversationId: string; messageId: string; conversationCreated: boolean }
+    | { ok: false; code: 'no_instance' }
+  >;
 };
 const kiloclawClientMock = jest.requireMock<KiloClawClientMock>(
   '@/lib/kiloclaw/kiloclaw-internal-client'
@@ -1197,3 +1215,101 @@ describe('kiloclawRouter destroy', () => {
     );
   });
 });
+
+describe('kiloclawRouter installFromSource', () => {
+  const installDispatchMock = jest.requireMock<{ __dispatchInstallFromSource: AnyMock }>(
+    '@/lib/kiloclaw/install-dispatch'
+  );
+
+  beforeEach(async () => {
+    await cleanupDbForTest();
+    installDispatchMock.__dispatchInstallFromSource.mockReset();
+  });
+
+  // Grant active KiloClaw access (a trialing subscription) so the
+  // clawAccessProcedure gate passes. Mirrors the `start` tests' fixture.
+  async function grantClawAccess(userId: string): Promise<void> {
+    const instanceId = crypto.randomUUID();
+    await db.insert(kiloclaw_instances).values({
+      id: instanceId,
+      user_id: userId,
+      sandbox_id: `ki_${instanceId.replace(/-/g, '')}`,
+    });
+    await db.insert(kiloclaw_subscriptions).values({
+      user_id: userId,
+      instance_id: instanceId,
+      plan: 'trial',
+      status: 'trialing',
+      trial_ends_at: '2026-12-31T23:59:59.000Z',
+    });
+  }
+
+  it('rejects a caller without active KiloClaw access (FORBIDDEN) and never dispatches', async () => {
+    const user = await insertTestUser({
+      google_user_email: `install-noaccess-${Math.random()}@example.com`,
+    });
+    const caller = createCaller({ user });
+
+    await expect(
+      caller.installFromSource({ source: 'byte', slug: 'deep-research' })
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    expect(installDispatchMock.__dispatchInstallFromSource).not.toHaveBeenCalled();
+  });
+
+  it('dispatches for an entitled caller and returns the dispatch result', async () => {
+    const user = await insertTestUser({
+      google_user_email: `install-access-${Math.random()}@example.com`,
+    });
+    await grantClawAccess(user.id);
+    installDispatchMock.__dispatchInstallFromSource.mockResolvedValue({
+      ok: true,
+      conversationId: 'conv_1',
+      messageId: 'msg_1',
+      conversationCreated: true,
+    });
+    const caller = createCaller({ user });
+
+    const result = await caller.installFromSource({ source: 'byte', slug: 'deep-research' });
+
+    expect(result).toEqual({
+      ok: true,
+      conversationId: 'conv_1',
+      messageId: 'msg_1',
+      conversationCreated: true,
+    });
+    expect(installDispatchMock.__dispatchInstallFromSource).toHaveBeenCalledWith({
+      userId: user.id,
+      source: 'byte',
+      slug: 'deep-research',
+    });
+  });
+
+  it('passes through the no_instance outcome', async () => {
+    const user = await insertTestUser({
+      google_user_email: `install-noinstance-${Math.random()}@example.com`,
+    });
+    await grantClawAccess(user.id);
+    installDispatchMock.__dispatchInstallFromSource.mockResolvedValue({
+      ok: false,
+      code: 'no_instance',
+    });
+    const caller = createCaller({ user });
+
+    const result = await caller.installFromSource({ source: 'byte', slug: 'deep-research' });
+
+    expect(result).toEqual({ ok: false, code: 'no_instance' });
+  });
+
+  it('rejects an unregistered source via input validation, without dispatching', async () => {
+    const user = await insertTestUser({
+      google_user_email: `install-badsource-${Math.random()}@example.com`,
+    });
+    await grantClawAccess(user.id);
+    const caller = createCaller({ user });
+
+    await expect(
+      caller.installFromSource({ source: 'hacker', slug: 'deep-research' })
+    ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    expect(installDispatchMock.__dispatchInstallFromSource).not.toHaveBeenCalled();
+  });
+});

From d1a478c4e5832be2ca7c4e8004a1c0a2b157335e Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 13:15:07 -0700
Subject: [PATCH 12/20] address possible message validation drift

---
 packages/kilo-chat/src/rpc-types.ts |  5 ++++-
 packages/kilo-chat/src/schemas.ts   | 11 ++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/packages/kilo-chat/src/rpc-types.ts b/packages/kilo-chat/src/rpc-types.ts
index 17fa6f3ffb..d4f9a3d75a 100644
--- a/packages/kilo-chat/src/rpc-types.ts
+++ b/packages/kilo-chat/src/rpc-types.ts
@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { messageTextSchema } from './schemas';
 
 // Cross-service RPC contracts exposed by the kilo-chat WorkerEntrypoint.
 //
@@ -34,7 +35,9 @@ export const postMessageAsUserCorrelationSchema = z.object({
 export const postMessageAsUserParamsSchema = z.object({
   userId: z.string().min(1).max(200),
   sandboxId: z.string().min(1).max(200),
-  message: z.string().min(1),
+  // Shared with `textBlockSchema` (the message-creation boundary) so the HTTP
+  // boundary and the service can't drift: trimmed, non-empty, ≤ 8000 chars.
+  message: messageTextSchema,
   // Origin identifier for diagnostics (e.g. "webhook", "onboarding-warmup").
   // Logged so structured-log queries can attribute new conversations to a
   // specific source.
diff --git a/packages/kilo-chat/src/schemas.ts b/packages/kilo-chat/src/schemas.ts
index 35d7cb0c18..1efa357d83 100644
--- a/packages/kilo-chat/src/schemas.ts
+++ b/packages/kilo-chat/src/schemas.ts
@@ -39,6 +39,15 @@ const trimmedNonEmptyString = (max: number) =>
 
 export const conversationTitleSchema = trimmedNonEmptyString(CONVERSATION_TITLE_MAX_CHARS);
 
+/**
+ * Validation for a single message text body. Shared source of truth so every
+ * boundary that accepts message text (the `textBlockSchema` used at message
+ * creation, and the `postMessageAsUserParamsSchema` HTTP boundary) enforces
+ * the SAME rule — trimmed, non-empty, ≤ MESSAGE_TEXT_MAX_CHARS — and cannot
+ * drift apart.
+ */
+export const messageTextSchema = trimmedNonEmptyString(MESSAGE_TEXT_MAX_CHARS);
+
 // 1-64 bytes UTF-8, no C0 (0x00-0x1F) or C1 (0x7F-0x9F) control chars.
 export const emojiSchema = z
   .string()
@@ -90,7 +99,7 @@ export const actionsBlockSchema = z
 
 export const textBlockSchema = z.object({
   type: z.literal('text'),
-  text: trimmedNonEmptyString(MESSAGE_TEXT_MAX_CHARS),
+  text: messageTextSchema,
 });
 
 const attachmentMetadataShape = {

From fa5c81ff29ec0eb84d3b7db219350828cf9382dd Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 14:09:38 -0700
Subject: [PATCH 13/20] feat(install): confirmation-card UX + dedicated  
 install conversation

---
 .../install/[source]/[slug]/InstallClient.tsx |  77 ++--
 .../components/icons/KiloClawbsterIcon.tsx    | 342 ++++++++++++++++++
 .../src/lib/kiloclaw/install-dispatch.test.ts |   1 +
 apps/web/src/lib/kiloclaw/install-dispatch.ts |   3 +
 packages/kilo-chat/src/rpc-types.ts           |   5 +
 .../__tests__/post-message-as-user.test.ts    |  29 ++
 .../src/services/post-message-as-user.ts      |  18 +-
 7 files changed, 451 insertions(+), 24 deletions(-)
 create mode 100644 apps/web/src/components/icons/KiloClawbsterIcon.tsx

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
index 036029f07d..5f03551af6 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -1,7 +1,6 @@
 'use client';
 
 import { useState } from 'react';
-import Link from 'next/link';
 import { useRouter } from 'next/navigation';
 import { useMutation } from '@tanstack/react-query';
 import { Loader2 } from 'lucide-react';
@@ -9,6 +8,16 @@ import { toast } from 'sonner';
 import { TRPCClientError } from '@trpc/client';
 import { useTRPC } from '@/lib/trpc/utils';
 import { Button } from '@/components/ui/button';
+import { Badge } from '@/components/ui/badge';
+import {
+  Card,
+  CardHeader,
+  CardTitle,
+  CardDescription,
+  CardContent,
+  CardFooter,
+} from '@/components/ui/card';
+import KiloClawbsterIcon from '@/components/icons/KiloClawbsterIcon';
 import type { InstallPayload } from '@/lib/kiloclaw/install';
 import type { InstallSource } from '@/lib/kiloclaw/install-sources';
 
@@ -19,19 +28,20 @@ type InstallClientProps = {
 };
 
 /**
- * Install preview + explicit dispatch. The signed payload was fetched and
- * verified server-side (and paid-access gated) in `page.tsx`; this shows the
- * user what's about to be installed.
+ * Install confirmation. The signed payload was fetched and verified
+ * server-side (and paid-access gated) in `page.tsx`; this is a permission-style
+ * confirm screen ("you're installing X from kilo.ai" plus what it does and the
+ * description) that the user explicitly confirms or cancels.
  *
- * Dispatch happens ONLY on an explicit Install click, which fires the
- * `installFromSource` POST mutation — never on GET render. A cross-site POST
+ * Dispatch happens ONLY on an explicit Confirm click, which fires the
+ * `installFromSource` POST mutation, never on GET render. A cross-site POST
  * can't carry the SameSite session cookie, so this closes the CSRF /
  * lure-a-click class that a GET-dispatch route would re-open.
  */
 export function InstallClient({ source, sourceLabel, payload }: InstallClientProps) {
   const router = useRouter();
   const trpc = useTRPC();
-  // `navigating` keeps the button disabled through the post-success redirect
+  // `navigating` keeps the buttons disabled through the post-success redirect
   // so a double-click can't fire a second dispatch while the route changes.
   const [navigating, setNavigating] = useState(false);
   const install = useMutation(trpc.kiloclaw.installFromSource.mutationOptions());
@@ -41,13 +51,14 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
       const result = await install.mutateAsync({ source, slug: payload.slug });
       setNavigating(true);
       if (result.ok) {
-        router.push('/claw/chat');
+        // Open the conversation the dispatch created, so the user lands
+        // directly in the installed chat, not the blank conversation index.
+        router.push(`/claw/chat/${result.conversationId}`);
         return;
       }
-      // No active instance yet — send them to set one up. We intentionally do
+      // No active instance yet, so send them to set one up. We intentionally do
       // NOT persist the install intent across the (long, multi-step) onboarding
       // flow; the user finishes setup, then installs again from the byte page.
-      // Re-running the install link is cheap and predictable.
       router.push('/claw/new');
     } catch (err) {
       const message =
@@ -61,17 +72,41 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
   const busy = install.isPending || navigating;
 
   return (
-    <div className="mx-auto flex min-h-[60vh] max-w-xl flex-col items-center justify-center gap-4 px-6 py-12 text-center">
-      <p className="text-muted-foreground text-sm tracking-wide uppercase">{sourceLabel}</p>
-      <h1 className="text-2xl font-semibold">{payload.title}</h1>
-      <p className="text-muted-foreground text-sm">{payload.description}</p>
-      <Button type="button" onClick={onInstall} disabled={busy} className="mt-2">
-        {busy ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
-        {busy ? 'Installing…' : 'Install'}
-      </Button>
-      <Link href="/claw/chat" className="text-muted-foreground text-sm underline">
-        Cancel
-      </Link>
+    <div className="mx-auto flex min-h-[60vh] w-full max-w-lg items-center px-6 py-12">
+      <Card className="w-full text-left">
+        <CardHeader>
+          <Badge variant="secondary" className="w-fit gap-1.5">
+            <KiloClawbsterIcon className="h-4 w-auto" />
+            {sourceLabel}
+          </Badge>
+          <CardTitle className="mt-2 text-xl">{payload.title}</CardTitle>
+          <CardDescription className="leading-relaxed">
+            You’re installing a {sourceLabel} from kilo.ai. Clicking Confirm Install starts a new
+            KiloClaw conversation and runs its prompt on your behalf. If you don’t want to install
+            this, then click Cancel.
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <p className="text-muted-foreground text-sm font-medium">
+            This {sourceLabel} installs a skill to:
+          </p>
+          <p className="text-foreground mt-2 text-sm leading-relaxed">{payload.description}</p>
+        </CardContent>
+        <CardFooter className="justify-end gap-3">
+          <Button
+            type="button"
+            variant="ghost"
+            disabled={busy}
+            onClick={() => router.push('/claw/chat')}
+          >
+            Cancel
+          </Button>
+          <Button type="button" onClick={onInstall} disabled={busy}>
+            {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : null}
+            {busy ? 'Installing…' : 'Confirm Install'}
+          </Button>
+        </CardFooter>
+      </Card>
     </div>
   );
 }
diff --git a/apps/web/src/components/icons/KiloClawbsterIcon.tsx b/apps/web/src/components/icons/KiloClawbsterIcon.tsx
new file mode 100644
index 0000000000..9dee829dc8
--- /dev/null
+++ b/apps/web/src/components/icons/KiloClawbsterIcon.tsx
@@ -0,0 +1,342 @@
+export default function KiloClawbsterIcon({ className }: { className?: string }) {
+  return (
+    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 134 164" fill="none" className={className}>
+      <path
+        fill="#000"
+        d="M10.89 5.145c.22-.338 2.345-1.772 2.805-2.04 2.827-1.649 5.748-3.203 9.11-3.1 1.797.637 2.073 1.396 2.19 3.285-.242.686-.88 2.59-1.267 3.094A40 40 0 0 0 22.6 9.348c-.149 1.443.43 4.84.204 5.353-1.546 3.509-2.119 2.985-.411 6.777.314.696-.366 4.188.197 4.99.417-.168 1.572-2.195 1.836-2.716.732-1.442.25-3.182.508-4.642.238-1.35 1.467-2.613 1.494-4.089.463-2.104-1.78-6.035.326-7.441.426-.285 1.492-.117 1.914.11 7.966 4.302 10.085 18.334 7.049 25.913.917 1.7 1.193 1.639 1.618 3.59.072.785.263 2.463.111 3.169a21.4 21.4 0 0 1-4.542 12.613c2.332 1.327 3.62 4.196 4.788 6.539 3.002-.268 3.973 2.493 5.908 4.46 1.297 1.318 1.763 1.733 3.245 2.772 2.676-11.471 6.812-20.733 12.907-30.738-.286-1.305-.492-2.659-.833-3.945-2.121-8.052-5.471-15.812-10.42-22.533A57 57 0 0 0 45.5 5.826c-.744-.842-3.113-2.765-2.79-3.892.969-.352 2.562 1.232 3.237 1.848 4.72 4.316 7.626 9.564 10.516 15.159.112.241.343.79.49.98.776 2.187 1.741 4.098 2.506 6.448.72 2.213 1.25 4.983 1.952 6.973.34.194.712.066 1.2.031.434.176.666.497.993.846.404-1.46 1.375-4.822 2.569-5.62 1.742-1.162 3.03 4.426 3.53 5.3 1.143-.33.577-.867 2.136-.39.423-.668 1.544-5.657 1.954-6.857 3.034-8.867 7.537-17.634 14.703-23.867.595-.517 1.718-1.366 2.35-.57-.26.786-5.106 6.076-6.107 7.465-5.795 8.04-9.22 16.765-11.15 26.398 5.664 9.381 10.726 19.91 12.873 30.741 2.722-1.95 4.088-3.856 6.265-6.293.8-.896 1.774-1.077 2.935-1.005 1.322-2.577 2.379-5.023 4.867-6.575-1.947-2.176-3.405-5.743-4.056-8.602-.547-2.403-.881-6.152-.043-8.565.112-.323 1.068-1.832 1.299-2.2-2.898-7.36-1.017-20.711 5.923-25.304 2.776-1.592 4.494-.742 3.807 2.594-.118 1.647-.859 3.83-.146 5.623.346.87 1.039 1.875 1.165 2.805.185 1.35-.125 3.02.483 4.31.276.587 1.383 2.687 1.923 2.9l.17-.162c.166-1.079-.288-2.644.003-4.3.025-1.107 1.19-2.96 1.087-3.943-.297-1.297-1.273-2.155-1.548-3.492-.312-1.519.451-3.048.33-4.52-.169-2.057-1.614-3.952-2.226-5.884-.47-1.48-.282-3.731 1.58-4.093 3.564-.593 7.689 1.922 10.582 3.742l.75.535c6.512 5.232 10.462 11.708 11.487 20.131.246 2.019.389 5.406.104 7.41-.045.9-.14 1.764-.235 2.658-1.851 10.357-7.432 21.306-17.659 25.639-.799.338-1.695.549-2.423 1.022l.016.161c.118 1.41-.153 2.487-1.107 3.569-1.497 1.697-4.571 3.353-6.698 4.057-.416 1.835-.674 2.28-2.322 3.304-4.63 2.875-8.072 4.628-13.201 6.296.067 1.06.165 2.302.17 3.36 2.531-.454 4.034-1.061 6.492-1.818 1.974-.6 5.685-2.164 7.563-1.465 1.262-1.506 3.102-2.704 4.5-4.178 2.572-2.713 4.617-5.994 7.337-8.542 1.83-1.714 4.415-.967 4.329 1.687-.046 2.339-1.076 4.733-2.404 6.596-.342.497-.987 1.492-1.353 1.908-2.769 3.496-5.933 6.282-10.036 8.142-.81.366-1.64 1.116-2.512 1.407-4.826 1.608-8.771 2.273-13.815 2.707l-.046.763-.047.764c4.427-.458 7.8-1.072 12.168-2 1.627-.346 2.986-.096 4.557.293 2.843.41 5.097.96 7.717 2.247.717.392 1.981 1.109 2.597 1.597 3.267 2.028 6.446 4.958 7.663 8.733.766 2.381-1.761 3.635-3.818 2.28-3.572-2.356-6.825-5.137-10.759-6.936-1.158-.526-2.565-1.085-3.656-1.717-2.752 1.73-14.72.446-17.72.946 2.168.394 13.568.96 15.732 1.44.447.097 1.472.317 1.736.69.687.969 1.925 1.13 2.847 1.815 2.217 1.692 4.503 4.395 6.081 6.689 1.876 2.728 4.177 6.95 3.721 10.348-.288 2.144-2.772 2.312-4.128.77-1.816-2.064-3.251-4.253-4.881-6.45-1.71-2.237-3.378-4.601-5.222-6.728-1.812.432-15.44-3.712-17.386-4.074.951.414 14.33 4.721 14.701 5.737.464 1.316 1.827 2.25 2.348 3.568 2.195 5.551 4.294 12.455 1.99 18.264-.52 1.315-2.099 1.585-3.203.87-.686-.446-.93-1.492-1.212-2.226-.719-2.48-1.124-5.13-1.717-7.647-.484-2.057-1.173-4.035-1.613-6.112-.291-1.306-.164-1.173-1.434-1.632-3.28-1.085-9.262-4.237-12.307-5.96-.35.355-.717.715-1.058 1.078.984 2.88 1.575 6.34-.251 9.002 1.113 3.177 1.495 7.775-1.045 10.4.807 3.278.449 7.172-2.226 9.52.18 1.923.126 2.684-.285 4.566 2.85.431 6.558 1.553 9.02 3.01l.708.37c2.193 1.352 4.171 2.996 4.807 5.616a6.3 6.3 0 0 1-.75 4.808c-1.711 2.765-4.677 3.715-7.772 3.486-.57 1.718-1.284 3.269-3.019 4.127a10 10 0 0 1-.71.304c-.487.269-.57.303-1.114.419q-.466.132-.94.217c-2.305.424-5.028-.214-6.945-1.547q-.541.65-1.193 1.186c-1.71 1.388-3.712 2.075-5.918 1.838a8.08 8.08 0 0 1-5.331-2.929c-.638.364-1.332.775-2.033.987-4.833 1.458-9.085.31-10.75-4.593-2.148.085-3.505.06-5.424-1.12-1.447-.885-2.883-2.65-3.167-4.37-1.285-7.775 8.935-10.661 14.594-11.871-.47-1.825-.51-2.657-.305-4.527-2.679-2.477-2.932-6.137-2.139-9.505-2.878-3.062-2.084-6.913-1.146-10.611-1.737-1.666-1.265-6.94-.156-8.695l-1.22-1.214c-2.561 1.617-10.498 5.715-13.339 6.329-.51 2.551-1.497 5.561-2.094 8.165-.634 2.766-1.096 5.993-2.197 8.554l-.34.412c-1.456 1.103-3.057.56-3.6-1.13-1.796-5.579-.17-12.241 1.97-17.517.635-1.562 1.94-2.487 2.578-4.06.384-.947 13.345-5.267 14.237-5.567-1.992.32-15.165 4.402-17.011 4.065-3.13 3.772-5.916 7.799-8.817 11.74-.835 1.059-1.712 2.364-3.175 2.509-1.357.135-2.222-1.121-2.258-2.35-.125-4.198 2.773-8.829 5.39-11.934.78-1.055 1.662-1.978 2.59-2.899 1.638-1.918 3.577-2.228 4.845-3.757 1.908-.742 15.115-1.626 17.436-1.874-3 0-15.23.726-17.723-.931-.68.343-1.462.694-2.16.975-4.212 1.69-7.716 4.394-11.337 7.047-1.742 1.276-4.49 2.138-4.906-.859-.213-1.531 1.731-4.239 2.686-5.343a23.2 23.2 0 0 1 15.835-7.93c.583-.43 1.022-.69 1.764-.644 2.622.163 5.24.84 7.832 1.283 2.534.433 4.457.643 7.009.902v-1.5c-5.286-.466-9.935-1.252-14.992-2.916-.46-.152-1.134-1.029-1.784-1.287-2.794-1.108-5.264-2.985-7.416-5.06-2.915-2.878-6.362-7.533-6.436-11.746.008-.686.398-1.45.91-1.883 1.51-1.273 3.267.187 4.343 1.31.856.893 1.645 1.87 2.397 2.868.576.698 1.295 1.525 1.805 2.255.955 1.027 1.911 2.22 2.899 3.192 1.246 1.227 2.622 2.412 3.913 3.61.391-.166 1.14-.383 1.543-.274 4.502 1.227 7.754 2.538 12.33 3.54.158-1.002.232-2.316.319-3.347-5.151-1.67-9.179-3.657-13.742-6.727-1.17-.787-1.61-1.566-1.815-2.904-2.187-.793-4.99-2.383-6.641-4.01-1.313-1.294-1.107-2.024-1.088-3.736-.706-.493-1.919-.757-2.727-1.124-2.473-1.153-4.737-2.642-6.733-4.53C2.38 47.405-1.54 34.04.553 22.333c.786-4.4 3.57-10.33 6.56-13.558 1.062-1.31 2.466-2.587 3.777-3.631"
+      />
+      <path
+        fill="#fa483a"
+        d="M48.41 99.582c-.061-.39-.314-1.012-.423-1.443-2.727-10.754-1.146-23.112 1.564-33.708.364.811 1.03 1.821 1.566 2.53a19.36 19.36 0 0 0 13.13 7.566c4.856.632 10.358-.786 14.217-3.838.57-.452 1.129-.912 1.707-1.358 1.494-1.657 2.59-2.886 3.588-4.906 2.943 10.833 5.032 26.75.271 37.536-1.927 4.368-6.004 1.236-9.035.38-4.155-1.217-8.033-1.461-12.333-.989l-1.867.372c-2.174.435-4.348 1.293-6.409 2.117-3.688 1.478-4.965-1.276-5.976-4.259"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M80.171 69.331c1.494-1.657 2.59-2.886 3.588-4.906 2.943 10.833 5.032 26.75.271 37.536-1.927 4.368-6.004 1.236-9.035.38-4.155-1.217-8.033-1.461-12.333-.989l-1.867.372c-2.174.435-4.348 1.293-6.409 2.117-3.688 1.478-4.965-1.276-5.976-4.259 2.378 2.597 4.6 1.596 7.36.529 4.19-1.62 8.362-2.445 12.867-2.234 3.315.154 8.397 1.867 10.212-1.889 3.221-6.9 2.751-15.612 1.693-22.978-.171-1.187-.111-2.602-.371-3.679"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M60.79 101.722c-.635-.75-3.658.081-4.59-.362.91-.414 5.415-.281 6.458-.01z"
+      />
+      <path
+        fill="#fa483a"
+        d="M5.345 43.702c-.205-.362-.378-.835-.54-1.223-3.302-7.945-3.781-17.685-.297-25.682A26.67 26.67 0 0 1 19.244 2.653c.978-.379 2.335-.881 3.332-.441.308.397.203.333.21.968-.19.497-.336.929-.594 1.396-.829 2.103-2.18 4.348-1.744 6.662.126.887.558 2.145.366 3.039-.271 1.269-1.432 2.041-1.64 3.4-.267 1.748 1.048 2.843 1.202 4.43.182 1.882-.688 3.954.555 5.664.638.939 1.447 1.457 2.18 2.248.223.198 1.93 1.73 2.04 1.904l1.208.725c1.643.648 4.284.564 5.48 1.146.75.288 1.187.42 1.808.947 3.19 2.266 1.369 9.513.198 12.554-.435 1.13-1.255 2.609-1.962 3.604-.338.433-.693.991-1.157 1.23-.117-.054-.256-.106-.353-.18-6.155-2.038-7.185 2.894-7.927 7.485-5.814-.899-11.581-6.07-14.553-10.975-.838-1.243-2.018-3.334-2.548-4.757"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M31.838 33.795c.75.289 1.187.42 1.808.947 3.19 2.267 1.369 9.513.198 12.554-.436 1.13-1.255 2.61-1.962 3.605-.338.432-.693.99-1.158 1.23-.116-.055-.255-.106-.352-.18-6.156-2.039-7.185 2.893-7.927 7.484-5.814-.898-11.581-6.07-14.553-10.975-.838-1.242-2.019-3.333-2.548-4.756.669-.147 1.544.187 1.544.187s.706 1.288.886 1.77c2.8 4.244 8.405 8.267 13.684 6.867 6.838-1.813 11.306-7.829 11.086-14.826-.086-.886-.367-2.479-.684-3.322v-.576z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M30.37 51.953c.073-.54.393-1.406.928-1.622.399.148.289.134.58.571-.337.433-.692.992-1.157 1.23-.116-.054-.255-.105-.352-.18"
+      />
+      <path
+        fill="#fff"
+        d="M5.345 43.703c-.205-.362-.378-.835-.54-1.224-3.302-7.945-3.781-17.684-.297-25.681A26.67 26.67 0 0 1 19.244 2.653c.978-.378 2.335-.88 3.332-.44.308.397.203.332.21.967-3.277-.14-5.653 1.773-7.911 3.8-10.15 9.114-12.43 21.964-8.62 34.76.248.836 1.145 2.298.99 3.048-.308.073-.635-.211-.635-.211s-.596-1.021-1.265-.874"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M20.542 6.551c.345-1.16.6-1.42 1.643-1.975-.828 2.103-2.179 4.348-1.743 6.662.125.887.557 2.145.366 3.039-.272 1.27-1.433 2.042-1.64 3.4-.268 1.749 1.047 2.844 1.201 4.43.183 1.882-.687 3.954.556 5.664.637.939 1.446 1.457 2.179 2.249l-.217-.129c-.858-.488-2.694-1.401-3.237-2.249-3.115-4.859-2.427-10.837-1.187-16.177.238-1.026.97-2.317 1.383-3.284l.06-.143z"
+      />
+      <path
+        fill="#fa483a"
+        d="M26.351 32.65c.209.304.255.313.254.685l-.2.146c-.679-.08-1.728-1.093-2.053-1.663l.113-.08.497.269.181-.082zM112.509 7.762c-.344-1.332-2.372-4.507-1.764-5.549 1.601-1.083 8.194 2.69 9.586 3.938.954.657 1.678 1.316 2.542 2.075 12.433 12.141 10.215 32.856-1.092 45.032-2.602 2.801-6.992 5.515-10.794 6.174-.634-2.326-.452-3.753-1.701-5.959-.796-.896-1.205-1.133-2.22-1.705-1.572-.485-2.104-.344-3.659.009-.567.246-.431.292-.925.185-.138-.118-.442-.501-.574-.659-2.695-3.101-4.99-10.799-3.392-14.953.507-1.32 1.799-2.061 3.083-2.53 1.066-.472 1.995-.386 2.998-.67 3.307-.002 4.852-2.52 7.138-4.54a6 6 0 0 0 1.118-1.33c.6-1.359.231-3.458.218-5.024.062-.565.279-1.015.489-1.546 2.237-4.543-1.88-4.398-.737-8.733.439-1.67.195-2.607-.314-4.215"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M122.876 8.227c12.434 12.14 10.215 32.856-1.091 45.031-2.602 2.801-6.993 5.515-10.794 6.174-.635-2.326-.452-3.753-1.702-5.959 2.065.223 3.796-.506 5.509-1.627 6.188-4.05 9.692-11.238 11.294-18.229 2.036-8.88.329-17.618-4.497-25.282.406-.008.828-.1 1.281-.108"
+      />
+      <path
+        fill="#fff"
+        d="M112.51 7.762c.695-1.019-.07-2.65.247-2.869.406.43.933 1.532 1.211 2.111a26.6 26.6 0 0 1 2.617 12.046c-.076 2.886-.941 7.51-2.923 9.948-.186.229-.475.193-.789.225l-.186-.136c.011-.986.463-.867.167-1.807.6-1.359.23-3.458.217-5.024.063-.565.279-1.015.49-1.546 2.236-4.543-1.88-4.398-.738-8.733.439-1.67.195-2.607-.313-4.215"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M120.328 6.151c.954.657 1.679 1.316 2.542 2.075-.453.01-.875.1-1.281.11a8 8 0 0 1-1.261-2.185"
+      />
+      <path
+        fill="#fa483a"
+        d="m101.914 51.301.345-.314c.208.137.396.152.637.192l.195.22c-.185.408-.139.284-.603.561-.137-.118-.441-.501-.574-.659M64.43 39.068c.162-.351.52-1.782.633-2.218.494-1.896.822-3.47 1.582-5.29.672 1.58 1.078 3.12 1.555 4.768.223.892.508 2.204.846 3.023.322.921.73 2.243 1.091 3.11.512 2.172 1.33 4.514 4.002 4.395 1.211-.633 1.458-1.038 1.935-2.369 2.155 4.508 4.245 8.844 5.794 13.613.317.978.803 2.134.936 3.183.035 1.908-2.057 4.64-3.165 5.914a17.98 17.98 0 0 1-12.823 5.554c-1.102.018-4.26-.202-5.178-.72a10.5 10.5 0 0 1-2.628-1.009c-.724-.194-2.702-1.517-3.294-2.035l-.32-.259c-.848-.325-2.895-2.914-3.416-3.763-.913-1.373-1.052-1.815-1.556-3.418.505-1.454.91-3.014 1.43-4.505q1.64-4.592 3.678-9.023c.362-.801 1.115-2.586 1.637-3.213.57-.019.49 2.5 3.397 1.92 1.211-.82 2.02-2.16 2.02-2.16l.725-2.379.578-1.796z"
+      />
+      <path
+        fill="#fff"
+        d="M50.424 61.547c.505-1.453.91-3.013 1.43-4.504 1.093-3.06 2.32-6.071 3.678-9.023.362-.802 1.115-2.587 1.637-3.214.57-.018.49 2.5 3.397 1.92-.63.458-1.464.204-2.177.165-.596 1.943-1.867 3.725-2.58 5.639-1.466 3.93-3.142 8.296-3.829 12.435-.913-1.373-1.052-1.815-1.556-3.418"
+      />
+      <path
+        fill="#fa483a"
+        d="m53.926 106.11.187-.049c1.712-.453 3.385-1.267 5.1-1.785a26.26 26.26 0 0 1 15.724.23c2.524.809 3.924 1.843 6.606 1.745.315 1.297.61 2.423.767 3.751.432 3.632-1.611 3.86-4.52 4.423q-.879.178-1.764.314c-6.643 1.366-12.98 1.239-19.587-.131-.898-.186-4.115-.811-4.619-1.282-1.458-1.366-.324-5.369.075-6.951.547-.026 1.458-.181 2.03-.265"
+      />
+      <path
+        fill="#ac1d0e"
+        d="m53.926 106.11.187-.049c1.712-.453 3.385-1.267 5.101-1.785a26.26 26.26 0 0 1 15.723.23c2.525.809 3.924 1.843 6.606 1.745.315 1.297.61 2.423.767 3.751.432 3.632-1.61 3.86-4.52 4.423q-.879.178-1.764.314l.582-1.052.093-.292q.045-.477.071-.957c.09-1.697-.279-3.959-1.666-5.01-2.993-2.266-7.542-2.284-11.03-2.349-.915.014-1.799-.016-2.624.384-.16.077-.399.063-.576.062-2.53.575-4.096 1.073-6.334 2.41l-.165-.113c-.027-.375.063-.542.186-.893-.109-.497-.14-.444-.637-.819"
+      />
+      <path
+        fill="#fa483a"
+        d="M81.383 115.68c.466 1.79 1.108 4.701.249 6.46-.004.549-.495 1.129-.822 1.573-1.7.752-3.787 1.216-5.62 1.578-5.414 1.294-13.268 1.336-18.59-.364-.173-.015-.485-.107-.666-.152l-.217-.048c-2.645-.605-4.26-1.283-4.361-4.338-.058-1.695.301-3.086.672-4.715 8.797 2.313 14.589 2.584 23.479 1.307a70 70 0 0 0 5.876-1.301"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M81.391 115.681c.466 1.79 1.108 4.701.248 6.46-.004.549-.494 1.129-.821 1.573-1.7.751-3.787 1.216-5.62 1.578 1.353-3.001 2.162-4.027.92-7.346-.034-.418-.312-.696-.604-.964a70 70 0 0 0 5.877-1.301"
+      />
+      <path
+        fill="#fa483a"
+        d="M74.128 127.752c1.83-.466 4.391-1.063 6.126-1.651 1.285 6.819-2.304 8.009-8.104 9.001-4.105.702-9.834.722-13.77-.659-1.693-.363-3.552-.99-4.54-2.453-1.066-2.091-.962-3.563-.762-5.866.661.111 1.555.388 2.22.586 6.135 1.821 12.513 2.022 18.83 1.042"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M74.13 127.752c1.83-.466 4.392-1.063 6.126-1.651 1.285 6.819-2.304 8.009-8.104 9.001-4.105.702-9.834.722-13.77-.659l.782-.154.05-.127-.4-.153.038-.006c.12-.173 1.19-.373 1.513-.459 1.148.03 3.246.618 4.547.473 3.158-.398 7.346-.683 9.735-2.993 1.113-1.075.558-2.428-.517-3.272"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M53.844 131.991c.11-.038.312-.117.431-.079 2.037.631 3.999 1.203 6.091 1.633-.322.085-1.393.285-1.513.459l-.038.006.4.153-.05.127-.78.154c-1.693-.363-3.553-.991-4.541-2.453"
+      />
+      <path
+        fill="#fa483a"
+        d="m60.117 146.297.167-.501c.316-.138 4.161.76 4.79.86l.098-.008c3.457-.236 4.273.22 8.03-1.066 1.463 4.696.68 13.731-4.97 15.424a5.26 5.26 0 0 1-4.07-.443c-1.008-.562-2.15-1.701-2.65-2.74-.25-.238-.398-.609-.563-.932-1.407-3.179-1.764-7.252-.832-10.594"
+      />
+      <path
+        fill="#ac1d0e"
+        d="m60.123 146.297.167-.501c.316-.138 4.16.76 4.79.86l.098-.008c3.457-.236 4.273.22 8.03-1.066 1.463 4.696.68 13.731-4.97 15.424a5.26 5.26 0 0 1-4.07-.443c-1.009-.562-2.151-1.701-2.65-2.74.161.027.253.043.393.135 5.315 3.489 8.706-1.798 9.065-6.614.093-1.246.03-2.342-.013-3.542-3.366 1.359-5.533.627-8.778-.599-.39-.052-.42-.094-.76-.273-.345-.251-.824-.305-1.302-.633"
+      />
+      <path
+        fill="#fa483a"
+        d="M27.869 9.492c.925.564 1.474.921 2.181 1.75 1.341 1.494 3.022 4.196 3.463 6.162 1.22 3.14 1.677 6.768 1.384 10.119-.029.332-.113 1.487-.243 1.74-.14 1.03-.314 2.04-.689 3.013l-.129.082c-.916-.397-1.529-.627-2.51-.837-2.255-.482-3.528-.04-5.3-1.628-.557-.396-1.235-1.058-1.753-1.535-.024-.349.285-.793.466-1.122.738-1.166 1.342-2.035 1.892-3.31l.276-1.005c.254-1.13.1-2.418.016-3.58.426-.658.88-1.501 1.274-2.194.023-.464.218-1.252.256-1.935.119-2.137-.201-3.653-.584-5.72"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M32.3 18.14c.272-.445.388-.761.857-.953l.356.216c1.22 3.14 1.677 6.769 1.384 10.12-.029.332-.113 1.486-.243 1.74-.14 1.029-.314 2.04-.689 3.013l-.129.081c-.916-.397-1.529-.627-2.51-.837-2.255-.481-3.528-.039-5.3-1.628-.557-.396-1.235-1.057-1.753-1.535-.024-.349.285-.792.466-1.122 1.492 1.08 3.38 2.441 5.35 2.292.426-.032 1.102-.217 1.292-.606 1.416-2.903 1.374-7.764.919-10.781"
+      />
+      <path
+        fill="#fa483a"
+        d="M30.048 11.243c1.34 1.494 3.021 4.196 3.463 6.162l-.357-.216c-.469.19-.585.507-.857.952l-.16-.007c-.125-.526-.365-1.638-.486-2.158-.258-1.108-1.639-3.904-1.604-4.733M102.91 11.787c.906-1.098 1.391-1.418 2.582-2.242q-.15.843-.311 1.683c-.553 3.224-.6 5.41 1.302 8.113-.041.988-.107 1.963-.003 2.948.24 2.254 1.874 3.934 2.671 5.969-2.106 2.302-2.836 2.938-6.037 3.03-.345.075-1.223.294-1.53.284-.834.23-1.35.403-2.051.907-.516-1.682-.82-2.985-.987-4.749-.476-4.994 1.06-12.035 4.364-15.943"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M103.126 31.29c-.357-.02-.706.008-.991-.178.196-.42 1.459-1.054 1.942-1.424 2.338-1.773 1.186-5.018.508-7.397-.538-1.89-1.412-9.882.246-11.129l.362.067c-.553 3.224-.6 5.41 1.301 8.113-.04.988-.107 1.963-.002 2.949.239 2.253 1.873 3.933 2.671 5.968-2.107 2.302-2.837 2.938-6.037 3.03"
+      />
+      <path
+        fill="#fff"
+        d="M102.91 11.786c.446.281.209.209.738.226-.054.558-1.448 3.268-1.791 3.906-.694 1.299-.715 2.388-1.13 3.835-.668 2.33-.451 5.436-.36 7.842.118 1.704.997 2.116-.004 3.748.257.26.801.212 1.221.228-.834.231-1.35.404-2.051.907-.516-1.682-.82-2.985-.987-4.749-.476-4.994 1.06-12.035 4.364-15.943"
+      />
+      <path
+        fill="#fa483a"
+        d="M24.736 58.226c.335-2.888 1.81-6.209 5.329-4.084 1.745 1.053 2.167.198 3.44 2.177.764 1.095 1.415 2.235 2.083 3.39.776 1.345 1.733 2.442 1.267 4.102-.188.873-.328 1.228-.939 1.916-2.943 3.054-6.442 2.03-9.689.088-.671-.185-4.023-2.59-3.624-3.471.487-1.074 1.768-2.078 2.133-4.118"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M24.736 58.225c.611 1.848.498 2.344 2.154 3.683 1.364 1.104 2.855 2.434 4.615 2.871 1.121.235 3.383.112 4.535-.537l.815-.432c-.188.873-.328 1.228-.939 1.916-2.943 3.054-6.442 2.03-9.689.088-.671-.185-4.023-2.59-3.624-3.471.487-1.075 1.768-2.078 2.133-4.118"
+      />
+      <path
+        fill="#fa483a"
+        d="M96.519 63.591c-.028-.311-.095-1.123.047-1.43a43 43 0 0 1 3.663-6.354c.457-.656 1.663-1.174 2.417-1.452 1.265-.468 2.028-1.057 3.405-.678 1.85.529 2.229 2.318 2.453 3.995.234.807.386 1.834.71 2.54.5 1.079 2.27 1.27 1.333 2.835-1.474 2.174-4.743 3.665-7.142 4.468-1.485.497-3.454.003-4.734-.76-1.328-.792-1.843-1.718-2.152-3.164"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M97.471 64.315c2.326 1.82 6.957-.475 8.615-2.352 1.298-1.47 1.827-2.746 2.302-4.572l.117.28c.234.807.385 1.834.71 2.54.5 1.079 2.27 1.27 1.332 2.835-1.473 2.174-4.743 3.665-7.141 4.468-1.485.497-3.454.003-4.734-.76-1.328-.792-1.843-1.718-2.153-3.164z"
+      />
+      <path
+        fill="#fff"
+        d="M96.519 63.591c-.028-.311-.095-1.123.047-1.43a43 43 0 0 1 3.663-6.354c.457-.656 1.663-1.174 2.417-1.452 1.265-.468 2.028-1.057 3.405-.678-1.46 1.816-3.969 1.967-5.207 4.191-1.224 2.202-2.998 3.805-3.374 6.448z"
+      />
+      <path
+        fill="#fa483a"
+        d="M71.932 137.235c2.196-.411 3.974-.81 6.09-1.6.008 1.828-.068 2.556-.807 4.248-2.727 6.25-17.701 6.172-20.572.542-.905-1.141-1.253-2.702-1.258-4.134l.005-.443c.248-.111 1.056.192 1.387.297 4.637 1.467 10.324 1.959 15.155 1.09"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M71.931 137.235c2.196-.411 3.974-.81 6.09-1.6.009 1.828-.068 2.556-.806 4.248-2.727 6.25-17.702 6.172-20.572.542.507.162.723.194 1.14.505 1.758 1.228 5.56 1.881 7.827 1.757 1.955-.107 6.858-.959 7.259-3.608.135-.895-.278-1.323-.938-1.844M89.7 66.91c1.87-1.442 3.17-3.605 4.694-5.179l.134.124-.09.48c.007 1.42.033 2.098.47 3.447.882 1.27 1.558 2.087 2.95 2.84 1.798.82 2.859 1.179 4.817 1.19-4.325 3.207-9.374 5.143-14.452 6.8-.215-2.487-.817-5.216-1.192-7.723 1.07-.72 1.684-1.12 2.67-1.979"
+      />
+      <path
+        fill="#fa483a"
+        d="M89.697 66.91c1.87-1.442 3.17-3.605 4.694-5.179l.133.124-.09.48c.008 1.42.033 2.098.471 3.447.882 1.27 1.558 2.087 2.949 2.84-1.36.71-4.831 2.797-6.157 2.612-.758-.504-.97-1.435-1.295-2.305z"
+      />
+      <path
+        fill="#fff"
+        d="M89.697 66.91c1.87-1.442 3.17-3.605 4.694-5.179l.133.124-.09.48c-.176.602-.632 1.71-.666 2.19-.659 2.213-2.277 2.427-3.366 4.404z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M38.898 61.613c1.782 2.202 3.555 4.489 5.827 6.214.522.36 1.12.796 1.656 1.115-.392 1.308-1.18 6.125-1.304 7.636-3.646-1.035-10.523-3.849-13.516-6.153l-.71-.538c.757-.093 1.612-.264 2.372-.398.684-.22 1.282-.44 1.954-.698 1.682-.919 2.568-1.753 3.452-3.456.411-1.605.406-2.059.27-3.722"
+      />
+      <path
+        fill="#fa483a"
+        d="M38.9 61.613c1.781 2.202 3.554 4.489 5.826 6.214l-.49.004a6 6 0 0 0-.28.567c-.607 1.406-.337 2.133-1.223 3.688-2.407-.334-3.4-.886-5.475-2.21-.59-.375-1.412-.923-2.08-1.085 1.682-.919 2.568-1.753 3.452-3.456.411-1.605.406-2.059.27-3.722"
+      />
+      <path
+        fill="#fff"
+        d="M38.9 61.613c1.782 2.202 3.555 4.489 5.827 6.214-.338.064-.598.395-.77.572-.256.26-.527.24-.888.295-1.7.258-1.548-2.468-3.16-3.067-.417-.155-1.104-.283-1.104-.283l-.174-.009c.411-1.605.406-2.059.27-3.722"
+      />
+      <path
+        fill="#fa483a"
+        d="m54.591 141.232.613.776c.38.466.393.33.4.805-.643.995-1.613 1.517-2.51 2.402-2.678 3.085-4.327 5.26-5.215 9.359-.535.034-1.243.107-1.77.065-2.475-.194-4.723-1.903-4.974-4.48-.326-5.568 9.18-8.23 13.456-8.927"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M45.91 151.351c2.44-2.192 4.74-4.817 7.347-7.158-.061.335-.137.684-.16 1.021-2.68 3.084-4.329 5.26-5.216 9.358-.535.035-1.243.107-1.77.065-2.475-.193-4.723-1.903-4.974-4.479 1.406-.092 1.58 1.775 4.772 1.193"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M55.199 142.007c.38.466.394.33.4.805-.643.995-1.612 1.517-2.51 2.402.025-.336.1-.685.161-1.02a61 61 0 0 0 1.949-2.187"
+      />
+      <path
+        fill="#fa483a"
+        d="M78.888 141.248c1.566.193 2.303.328 3.81.808 3.194 1.11 7.424 2.674 9.14 5.78 1.299 2.854-.165 5.221-2.805 6.4-1.243.556-1.563.194-2.592.461-1.221-.15-1.035-1.133-1.356-2.203-1.929-4.436-4.002-6.626-7.522-9.75z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M78.888 141.248c1.566.193 2.303.328 3.81.808-1.351.655-1.572 1.06-1.47 2.478 2.254 2.246 4.229 4.25 5.757 7.078.564 1.046 2.918-.689 3.47-1.138.56-.515.73-.854 1.022-1.545.097-.341.246-.75.36-1.093 1.3 2.854-.164 5.221-2.804 6.4-1.243.556-1.563.194-2.592.461-1.221-.15-1.035-1.133-1.356-2.203-1.929-4.436-4.002-6.626-7.522-9.75z"
+      />
+      <path
+        fill="#fa483a"
+        d="M49.827 154.955c.555-3.035 4.777-9.804 7.714-10.714l.873.654c-.307 1.248-.48 2.167-.716 3.428-.122 1.512-.093 2.359-.054 3.876.394 2.664.673 3.937 1.852 6.339-2.576 1.279-6.285 2.042-8.534-.285-.953-1.022-1.404-1.87-1.135-3.298"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M57.65 152.198c.393 2.665.672 3.937 1.852 6.339-2.577 1.279-6.286 2.042-8.535-.285.467.025.722.037 1.187.005l.12-.185c-.148-.345-.216-.381-.509-.587.68-.205 1.5.163 2.088-.22l-.122-.125c.21-.094 2.635-.498 3.143-1.118.563-.689.755-2.933.776-3.824"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M50.962 158.25c-.953-1.021-1.404-1.869-1.135-3.297.107 2.137 2.193 2.301 3.898 2.185l.123.125c-.589.384-1.409.016-2.088.221.293.206.36.242.51.587l-.121.184a8 8 0 0 1-1.187-.005"
+      />
+      <path
+        fill="#fa483a"
+        d="m57.549 144.241.872.654c-.307 1.248-.479 2.167-.716 3.428-1.137-1.164-.032-2.317-.326-3.262-.332.077-.237.079-.566.06l.047-.164c.412-.241.505-.274.689-.716M75.09 144.906c.236-.231.65-.53.921-.74.894.695 1.553 1.29 2.38 2.049l.78.802c1.746 1.916 3.639 4.773 4.355 7.24l.038.43c.093.649.097.911.093 1.552-.205.849-.363 1.091-.896 1.784-2.473 2.479-5.946 1.988-8.761.414 1.163-2.015 1.542-3.843 1.84-6.105a67 67 0 0 0-.021-3.856c-.156-.463-.34-2.353-.729-3.57"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M75.09 144.906c.236-.231.65-.53.921-.74.894.695 1.553 1.29 2.38 2.049-.596.11-.92.189-1.231.743-.303 2.049.32 4.713-.04 6.895-.091.541-.485 2.192-.447 2.531.779.9 2.141.807 3.247.796l.065.195c.932.023 2.273-1.195 2.776.648-2.473 2.479-5.946 1.988-8.761.414 1.163-2.015 1.542-3.843 1.84-6.105a67 67 0 0 0-.021-3.856c-.156-.463-.34-2.353-.729-3.57"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M83.56 154.686c.093.648.097.911.093 1.551-.205.85-.363 1.092-.896 1.785-.503-1.843-1.844-.626-2.776-.649l-.065-.194c1.768-.347 2.886-.76 3.644-2.493M91.773 91.741c3.48-.354 6.9-1.077 10.333-1.73.773-.148 1.548-.258 2.337-.27.108.712.225 1.313.205 2.036.066.661.162.588-.086 1.09C103.252 93.899 88 93.91 88 93.91l-.117-1.918.683.018s2.38-.233 3.206-.27"
+      />
+      <path
+        fill="#fa483a"
+        d="M91.77 91.741c3.48-.354 6.9-1.077 10.333-1.73.773-.148 1.548-.258 2.337-.27.108.712.225 1.313.205 2.036l-.334-.225c-1.919.973-10.67 1.416-12.542.19M18.312 74.162c-.588-.873-3.805-6.132-2.546-6.889.48.117.836.536 1.216.889 1.634 1.464 4.284 5.33 6.143 7.322a42 42 0 0 0 2.68 2.612c.64.561 2.087 1.67 2.524 2.275a7 7 0 0 1-.183.947c-.052.475-.073.566-.356.815-.898.04-2.177-.958-2.974-1.476-.159.075-.08.026-.256.185l-.144.133c-1.335.163-.476-.527-1.256-1.122-.285.23-.312.3-.676.336-.292-.181-.301-.163-.497-.438l.435-.075-.065-.397.284-.183c-.45-.617-2.286-2.258-3.176-3.402-.285-.298-.888-1.166-1.154-1.532"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M18.315 74.162c.82-.556.115.277.953-.346l.747 1.059c1.055 1.074 2.066 2.138 3.218 3.11.946.975 1.4 1.083 2.196 1.793.578.276 2.449 1.073 2.72 1.54-.052.475-.073.567-.356.815-.898.041-2.177-.958-2.974-1.476-.159.075-.08.026-.256.186l-.144.132c-1.335.163-.476-.527-1.256-1.122-.285.23-.312.3-.676.336-.292-.181-.301-.163-.497-.437l.434-.075-.064-.397.284-.184c-.45-.617-2.286-2.258-3.176-3.402-.285-.298-.888-1.166-1.154-1.532"
+      />
+      <path
+        fill="#000"
+        d="M24.816 80.657c-.159.076-.08.027-.256.186l-.145.132c-1.334.164-.476-.526-1.255-1.121-.286.23-.312.3-.676.335-.293-.18-.301-.162-.498-.437l.435-.075-.064-.397.283-.183c.245.18 2.12 1.504 2.175 1.56"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M18.315 74.162c.82-.556.115.277.953-.346l.747 1.059-.099.172.364.394-.128.137c-.524-.068-.311-.136-.684.116-.285-.298-.888-1.166-1.154-1.532M28.68 91.733c.05-.773-.065-2.167.97-1.987 4.385.762 8.587 1.645 13.027 2.119.76-.035 1.329.03 2.081.1.095.805.124 1.144.242 1.946-3.66.04-7.245.343-10.888-.023q-1.739-.179-3.47-.422c-.293-.044-1.146-.221-1.37-.226-.76-.488-.65-.65-.592-1.507"
+      />
+      <path
+        fill="#fa483a"
+        d="M28.69 91.733c.05-.773-.065-2.167.97-1.987 4.385.762 8.587 1.645 13.027 2.119-4.934 1.338-7.792.282-12.253.272-.725 0-1.062-.163-1.745-.404"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M29.273 93.24c-.761-.488-.65-.65-.593-1.508.683.242 1.02.405 1.744.404l.178.18c-.368.127-.547.038-.97-.025-.09.672.028.504-.36.949M88.251 99.022c-.442-.135-.363-.04-.609-.344-.104-.933-.114-.994.367-1.79.376-.14.282-.088.743.005.662.154 2.412.314 2.864.491.415.049 2.549.284 2.798.395 3.122.356 7.251.606 10.233 1.153-.131.405-.661 1.796-.698 2.038-.11.473-.112.642-.385 1.028-1.633.455-13.26-2.303-15.313-2.976"
+      />
+      <path
+        fill="#fa483a"
+        d="M91.616 97.383c.415.048 2.548.284 2.798.395 3.122.355 7.251.606 10.232 1.152-.131.405-.661 1.796-.697 2.038-3.325-.549-7.523-1.017-10.643-2.21-.321-.135-1.725-.918-1.898-1.187z"
+      />
+      <path
+        fill="#fa483a"
+        d="M91.616 97.383c.415.048 2.548.284 2.798.395l-.245.13c.234.12.244.108.507.149l.12.1-.18.026c-.649.095-.81.114-1.31.574-.321-.134-1.725-.917-1.898-1.186z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M88.251 99.022c-.442-.135-.363-.04-.609-.344-.104-.933-.114-.994.367-1.79.376-.14.282-.088.743.005-.48.703-.186 1.313-.5 2.13M43.61 97.152c.667-.239.693-.12 1.39-.24l.5 1.5c-2.122.82-13.613 3.844-15.557 3.569-.315-.324-.339-.513-.492-.955-.106-.455-.553-1.634-.723-2.113 1.668-.352 3.797-.435 5.537-.61q4.687-.462 9.345-1.151"
+      />
+      <path
+        fill="#fa483a"
+        d="M28.729 98.913c1.667-.352 3.796-.436 5.536-.61q4.687-.462 9.345-1.152l.02.169c-3.642 1.997-9.96 3.34-14.18 3.706-.105-.455-.552-1.634-.721-2.113M105.679 79.751c1.422-1.424 3.369-2.979 4.885-4.583 1.361-1.44 5.708-7.37 6.955-7.91l.203.108c.188.521.154.6.113 1.17-.497 1.803-.634 2.307-1.6 3.937-1.561 2.717-5.122 6.787-7.882 8.297-.54.374-2.129 1.496-2.762 1.298l-.107-.308c-.178-.47-.265-.7-.38-1.186.143-.558.081-.373.575-.823"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M107.094 80.084c3.505-2.427 6.262-5.828 8.648-9.32.718 1.233-.303.873.495 1.709-1.561 2.716-5.122 6.787-7.882 8.296-.54.374-2.129 1.496-2.762 1.298l-.107-.308c.329-.733.743-.944 1.384-1.424z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="m106.87 80.334.163.213c.704-.091.784-.325 1.282-.155.017.12.043.26.04.377-.54.373-2.129 1.495-2.762 1.297l-.107-.308c.329-.733.743-.944 1.384-1.424M115.729 70.764c.333-.624.955-1.981 1.56-2.29.223-.113.221-.038.535.06-.497 1.804-.635 2.307-1.6 3.938-.799-.835.223-.476-.495-1.708M106.796 91.56c-.047-.344-.159-.761-.004-1.046 1.165-.375 4.794.982 5.974 1.598.612-.259 1.124-.24 1.757-.04l.096.206c-.223.286-.354.298-.695.418 2.476 1.487 5.507 3.53 7.098 5.992.77.888 1.156 2.01 1.588 3.093-2.201-1.081-5.612-3.846-8.027-5.336-3.028-1.87-4.705-2.303-7.634-3.835-.22-.3-.157-.654-.153-1.05"
+      />
+      <path
+        fill="#fa483a"
+        d="M106.796 91.56c-.047-.344-.159-.761-.004-1.046 1.165-.375 4.794.982 5.974 1.598.612-.259 1.124-.24 1.757-.04l.096.206c-.223.286-.354.298-.695.418 2.476 1.487 5.507 3.53 7.098 5.992-.621-.14-5.676-3.869-7.016-4.574-2.69-1.418-4.535-1.56-7.086-2.507z"
+      />
+      <path
+        fill="#000"
+        d="M112.76 92.113c.612-.259 1.124-.24 1.757-.04l.096.206c-.223.286-.354.297-.695.418z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M12.724 98.182c2.991-3.93 9.093-7.369 14.006-7.78-.059.614-.108.985-.055 1.61-.062.346-.02.523-.365.71-.67.363-1.44.625-2.128.938a36.3 36.3 0 0 0-7.58 4.255c-1.018.735-2.717 2.136-3.74 2.671-.442.356-1.138 1.068-1.647.674-.095-.962.927-2.353 1.509-3.078"
+      />
+      <path
+        fill="#fa483a"
+        d="M12.719 98.182c2.991-3.93 9.092-7.369 14.006-7.78-.059.614-.108.985-.055 1.61-.715-.287-3.399.437-4.074.899-2.616.85-4.259 1.923-6.465 3.564-.706.524-1.848 1.49-2.55 1.921l-.26-.157c-.207 0-.4-.016-.602-.057"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M91.969 83.48c1.536-.332 10.186-3.13 10.752-2.926.396.325.438.773.652 1.304.135.606.276 1.172.339 1.79-4.025 1.327-10.603 2.446-14.832 2.738l-.038-2.368c.71-.123 2.482-.482 3.127-.539"
+      />
+      <path
+        fill="#fa483a"
+        d="M91.973 83.48c1.536-.332 10.186-3.13 10.752-2.926.396.325.438.773.652 1.304-.847.446-1.61.884-1.61.884l-.214.066a22 22 0 0 1-9.58.671"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M17.06 113.786c1.026-4.247 3.826-7.771 6.75-10.901.64-.682 2.367-2.604 3.335-2.374.224.629.46 1.232.588 1.889-1.79 2.29-3.555 4.267-5.303 6.657-1.3 1.778-3.851 5.61-5.283 6.985l-.146-.009c-.186-.629-.166-1.638.06-2.247"
+      />
+      <path
+        fill="#fa483a"
+        d="M17.066 113.786c1.026-4.247 3.825-7.771 6.75-10.901.639-.682 2.367-2.604 3.335-2.374-.548 2.191-4.983 6.169-6.39 8.466-.389.634-2.92 4.649-3.223 4.922l-.336.101z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M106.45 100.401c2.42.712 6.838 6.826 8.214 9.103.745 1.355 1.556 3.049 1.735 4.604.188.441.265 1.372.126 1.874l-.2.086c-.852-.569-4.408-5.788-5.286-6.928-1.766-2.295-3.446-4.58-5.393-6.804.203-.666.39-1.383.804-1.935"
+      />
+      <path
+        fill="#fa483a"
+        d="M106.444 100.401c2.42.712 6.838 6.826 8.213 9.103l-.059.499c-.192.109-.33.183-.529.275l-.104.172-.077-.045c-2.138-2.96-4.996-5.357-7.07-8.367-.357-.518-.387-1.19-.374-1.637"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M30.704 80.397c1.903.42 4.189 1.244 6.105 1.817 2.433.73 4.504 1.206 6.95 1.77.215.058.526.073.617.263.292.6.297 1.442-.035 2.027-.292.057-.21.056-.508.043-4.467-.435-9.863-1.203-14.08-2.773l.212-1.242c.23-.753.343-1.221.74-1.905"
+      />
+      <path
+        fill="#fa483a"
+        d="M30.706 80.397c1.903.42 4.189 1.244 6.105 1.817 2.433.73 4.504 1.206 6.95 1.77-.896.373-.696-.253-1.082.224l-.028.296c-.631.402-1.263.887-2.263.387-3.641-1.82-9.853-2.39-9.853-2.39l-.568-.199c.23-.753.343-1.221.74-1.905"
+      />
+      <path
+        fill="#fa483a"
+        d="M43.76 83.984c.214.058.525.073.617.263.291.6.296 1.442-.036 2.027-.292.058-.21.056-.508.043.023-.447.013-.804-.128-1.223-1.026-.905-2.049.631-3.455-.737.778-.274 1.768.55 2.4.147l.028-.296c.386-.477.186.15 1.082-.224"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M28.502 122.947c-.265-4.017 1.025-8.171 2.32-11.946.251-.735.651-1.886 1.366-2.255.417.073.306.085.662.5.293.301.6.592.843.934a48 48 0 0 0-.815 2.455c-.408 1.803-.946 3.583-1.4 5.383-.683 2.701-1.017 6.306-2.163 8.775-.393-1.077-.893-2.695-.813-3.846"
+      />
+      <path
+        fill="#fa483a"
+        d="m100.752 108.937.368-.325.255.047c2.188 3.434 4.288 12.143 3.361 16.084-.218.866-.479 1.583-.778 2.425a329 329 0 0 0-3.579-15.058c-.252-.8-.38-1.424-.549-2.248z"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M86.702 101.189c.719.381 1.882.83 2.659 1.149 2.968 1.131 7.952 2.846 10.606 4.26-.356.461-.673.94-1.14 1.277-.314.261-.641.724-.905 1.057-2.39-.634-10.031-4.507-12.1-5.835.261-.618.595-1.294.88-1.908"
+      />
+      <path
+        fill="#fa483a"
+        d="M89.37 102.336c2.968 1.131 7.952 2.847 10.606 4.26-.357.461-.674.94-1.14 1.278-1.33-.782-9.676-4.149-9.467-5.538"
+      />
+      <path
+        fill="#ac1d0e"
+        d="m43.763 102.455 2.978-1.281c.256.565.529 1.202.811 1.749-1.45 1.1-11.309 6.509-12.433 5.842l-.093-.212-.739-.88c-.319-.321-.438-.533-.689-.914l-.1-.297c1.188-.511 2.336-1.007 3.557-1.437 2.075-.875 4.576-1.761 6.708-2.57"
+      />
+      <path
+        fill="#fa483a"
+        d="m43.763 102.454.033.273c-1.692 1.713-7.207 4.617-9.509 4.945-.319-.321-.438-.533-.689-.914l-.1-.297c1.188-.511 2.336-1.007 3.557-1.437 2.075-.875 4.576-1.761 6.708-2.57"
+      />
+      <path
+        fill="#ac1d0e"
+        d="M69.75 40.049c.173-.292.066-1.07.151-1.562.177-1.017.83-2.379 1.45-3.182.123 2.05-.195 3.52-.505 5.541l-.377-.241zM62.23 38.959c.025-.872-.306-2.223-.273-3.644.922 1.79 1.508 1.85 1.366 3.764-.237.375-.251.431-.599.69l-.256-.035c-.19-.318-.185-.417-.238-.775"
+      />
+    </svg>
+  );
+}
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
index 36640a27a6..f49ab9e656 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -87,6 +87,7 @@ describe('dispatchInstallFromSource', () => {
       message: 'Research [topic] for me.',
       source: 'install',
       autoCreateConversation: true,
+      forceNewConversation: true, // each install gets its own conversation
       correlation: { reason: 'clawbyte:deep-research' },
     });
 
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index c92a4c6c93..637175cafa 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -133,6 +133,9 @@ export async function dispatchInstallFromSource(
     message: payload.prompt,
     source: 'install',
     autoCreateConversation: true,
+    // Each install gets its own dedicated conversation rather than appending
+    // to whatever the user last chatted in.
+    forceNewConversation: true,
     correlation: { reason },
   });
 
diff --git a/packages/kilo-chat/src/rpc-types.ts b/packages/kilo-chat/src/rpc-types.ts
index d4f9a3d75a..135e365d7d 100644
--- a/packages/kilo-chat/src/rpc-types.ts
+++ b/packages/kilo-chat/src/rpc-types.ts
@@ -45,6 +45,11 @@ export const postMessageAsUserParamsSchema = z.object({
   // Default true. Pass false to fail the call if the user has never opened
   // a chat with this bot.
   autoCreateConversation: z.boolean().optional(),
+  // Default false. When true, always start a NEW conversation instead of
+  // reusing the user's most-recent one. The install flow sets this so each
+  // install lands in its own dedicated chat; webhook-style callers omit it to
+  // keep appending to the ongoing conversation.
+  forceNewConversation: z.boolean().optional(),
   correlation: postMessageAsUserCorrelationSchema.optional(),
 });
 
diff --git a/services/kilo-chat/src/__tests__/post-message-as-user.test.ts b/services/kilo-chat/src/__tests__/post-message-as-user.test.ts
index 9155f3855e..a58edb3d31 100644
--- a/services/kilo-chat/src/__tests__/post-message-as-user.test.ts
+++ b/services/kilo-chat/src/__tests__/post-message-as-user.test.ts
@@ -96,6 +96,35 @@ describe('postMessageAsUser', () => {
     expect(second.conversationId).toBe(first.conversationId);
   });
 
+  it('forceNewConversation always creates a fresh conversation even when one exists', async () => {
+    const userId = `user-${crypto.randomUUID()}`;
+    const sandboxId = `sandbox-${crypto.randomUUID()}`;
+    grantSandbox(userId, sandboxId);
+    const testEnv = makeEnv();
+
+    const first = await runPost(testEnv, {
+      userId,
+      sandboxId,
+      message: 'first',
+      source: 'webhook',
+    });
+    expect(first.ok).toBe(true);
+    if (!first.ok) return;
+
+    const installed = await runPost(testEnv, {
+      userId,
+      sandboxId,
+      message: 'installed byte prompt',
+      source: 'install',
+      forceNewConversation: true,
+    });
+    expect(installed.ok).toBe(true);
+    if (!installed.ok) return;
+    // A brand-new conversation, not the pre-existing one.
+    expect(installed.conversationCreated).toBe(true);
+    expect(installed.conversationId).not.toBe(first.conversationId);
+  });
+
   it('returns no_conversation when autoCreateConversation is false and none exists', async () => {
     const userId = `user-${crypto.randomUUID()}`;
     const sandboxId = `sandbox-${crypto.randomUUID()}`;
diff --git a/services/kilo-chat/src/services/post-message-as-user.ts b/services/kilo-chat/src/services/post-message-as-user.ts
index 70e51a4863..2bc2719a18 100644
--- a/services/kilo-chat/src/services/post-message-as-user.ts
+++ b/services/kilo-chat/src/services/post-message-as-user.ts
@@ -32,7 +32,15 @@ export async function postMessageAsUser(
   ctx: DeferCtx,
   params: PostMessageAsUserParams
 ): Promise<PostMessageAsUserResult> {
-  const { userId, sandboxId, message, source, autoCreateConversation = true, correlation } = params;
+  const {
+    userId,
+    sandboxId,
+    message,
+    source,
+    autoCreateConversation = true,
+    forceNewConversation = false,
+    correlation,
+  } = params;
 
   logger.setTags({ sandboxId, callerId: userId });
 
@@ -88,13 +96,17 @@ export async function postMessageAsUser(
   // rare: webhook triggers fire serially per trigger, and a user with
   // multiple triggers pointing at the same bot would only race on the very
   // first delivery across all of them.
-  const existingConversationId = await findUserBotConversation(env, userId, sandboxId);
+  // `forceNewConversation` skips the reuse lookup so the call always starts a
+  // fresh conversation (the install flow wants a dedicated chat per install).
+  const existingConversationId = forceNewConversation
+    ? null
+    : await findUserBotConversation(env, userId, sandboxId);
 
   let conversationId: string;
   let conversationCreated = false;
   if (existingConversationId) {
     conversationId = existingConversationId;
-  } else if (autoCreateConversation) {
+  } else if (autoCreateConversation || forceNewConversation) {
     const created = await createConversationFor(env, userId, { sandboxId });
     if (!created.ok) {
       logger.warn('postMessageAsUser: failed to create conversation', {

From 30d0f99ee1c3a2c65f919c3fb16fe0e5d638fd07 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 14:49:57 -0700
Subject: [PATCH 14/20] fix(install): bind dispatch to the reviewed   payload
 signature

---
 .../install/[source]/[slug]/InstallClient.tsx | 20 ++++++++++++----
 .../src/lib/kiloclaw/install-dispatch.test.ts | 24 ++++++++++++++++++-
 apps/web/src/lib/kiloclaw/install-dispatch.ts | 19 ++++++++++++++-
 apps/web/src/routers/kiloclaw-router.test.ts  | 18 ++++++++++----
 apps/web/src/routers/kiloclaw-router.ts       |  4 ++++
 5 files changed, 74 insertions(+), 11 deletions(-)

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
index 5f03551af6..e558686ed6 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -48,7 +48,13 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
 
   async function onInstall() {
     try {
-      const result = await install.mutateAsync({ source, slug: payload.slug });
+      const result = await install.mutateAsync({
+        source,
+        slug: payload.slug,
+        // Bind the dispatch to the exact payload shown here; the server rejects
+        // if the byte changed since this page rendered.
+        signature: payload.signature,
+      });
       setNavigating(true);
       if (result.ok) {
         // Open the conversation the dispatch created, so the user lands
@@ -61,10 +67,14 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
       // flow; the user finishes setup, then installs again from the byte page.
       router.push('/claw/new');
     } catch (err) {
-      const message =
-        err instanceof TRPCClientError && err.data?.code === 'NOT_FOUND'
-          ? 'This install link is no longer available.'
-          : 'Could not install this byte. Please try again.';
+      let message = 'Could not install this byte. Please try again.';
+      if (err instanceof TRPCClientError) {
+        if (err.data?.code === 'NOT_FOUND') {
+          message = 'This install link is no longer available.';
+        } else if (err.data?.code === 'CONFLICT') {
+          message = 'This byte changed since you opened this page. Please reload and try again.';
+        }
+      }
       toast.error(message);
     }
   }
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
index f49ab9e656..a67efc37e8 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -42,7 +42,12 @@ function makeDeps(
   };
 }
 
-const ARGS = { userId: 'user-1', source: 'byte' as const, slug: 'deep-research' };
+const ARGS = {
+  userId: 'user-1',
+  source: 'byte' as const,
+  slug: 'deep-research',
+  expectedSignature: VALID_PAYLOAD.signature,
+};
 
 describe('dispatchInstallFromSource', () => {
   afterEach(() => {
@@ -114,6 +119,23 @@ describe('dispatchInstallFromSource', () => {
     ).rejects.toMatchObject({ code: 'NOT_FOUND' });
   });
 
+  it('throws CONFLICT (and does NOT dispatch) when the re-fetched signature differs', async () => {
+    const dispatchSpy = jest.fn();
+    // Re-fetched payload is a newer, still-validly-signed version (different
+    // signature) than the one the user reviewed.
+    const changed: InstallPayload = { ...VALID_PAYLOAD, signature: 'different-sig' };
+    await expect(
+      dispatchInstallFromSource(
+        ARGS,
+        makeDeps({
+          fetchInstallPayload: async () => changed,
+          postMessageAsUser: dispatchSpy as never,
+        })
+      )
+    ).rejects.toMatchObject({ code: 'CONFLICT' });
+    expect(dispatchSpy).not.toHaveBeenCalled();
+  });
+
   it('returns no_instance (and does NOT dispatch) when user has no active instance', async () => {
     const dispatchSpy = jest.fn();
     const result = await dispatchInstallFromSource(
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index 637175cafa..e232ad746c 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -37,6 +37,12 @@ export type DispatchInstallFromSourceArgs = {
   userId: string;
   source: InstallSource;
   slug: string;
+  // The Ed25519 signature of the payload the user actually reviewed on the
+  // confirmation page. We re-fetch + re-verify server-side, then require the
+  // re-fetched payload's signature to match this, so a byte edited+re-signed
+  // between preview and confirm can't dispatch a different (still-valid)
+  // prompt than the one the user approved.
+  expectedSignature: string;
 };
 
 export type DispatchInstallFromSourceResult =
@@ -91,7 +97,7 @@ export async function dispatchInstallFromSource(
   args: DispatchInstallFromSourceArgs,
   deps: DispatchInstallFromSourceDeps = defaultDeps
 ): Promise<DispatchInstallFromSourceResult> {
-  const { userId, source, slug } = args;
+  const { userId, source, slug, expectedSignature } = args;
 
   const payload = await deps.fetchInstallPayload(source, slug);
   if (!payload) {
@@ -101,6 +107,17 @@ export async function dispatchInstallFromSource(
     });
   }
 
+  // Bind the dispatch to exactly what the user reviewed. The signature is the
+  // cryptographic identity of the signed content (slug/title/description/
+  // prompt); if it no longer matches, the byte changed since the confirmation
+  // page rendered, so refuse rather than run a prompt the user didn't approve.
+  if (payload.signature !== expectedSignature) {
+    throw new TRPCError({
+      code: 'CONFLICT',
+      message: 'This byte changed since you reviewed it. Please reload and confirm again.',
+    });
+  }
+
   const instance = await deps.getActiveInstance(userId);
   if (!instance) {
     // Don't dispatch yet — the user has no instance to deliver into. The
diff --git a/apps/web/src/routers/kiloclaw-router.test.ts b/apps/web/src/routers/kiloclaw-router.test.ts
index 0ea3537a71..7fbf4bc310 100644
--- a/apps/web/src/routers/kiloclaw-router.test.ts
+++ b/apps/web/src/routers/kiloclaw-router.test.ts
@@ -216,6 +216,7 @@ let createCaller: (ctx: { user: Awaited<ReturnType<typeof insertTestUser>> }) =>
   installFromSource(input: {
     source: string;
     slug: string;
+    signature: string;
   }): Promise<
     | { ok: true; conversationId: string; messageId: string; conversationCreated: boolean }
     | { ok: false; code: 'no_instance' }
@@ -1251,7 +1252,7 @@ describe('kiloclawRouter installFromSource', () => {
     const caller = createCaller({ user });
 
     await expect(
-      caller.installFromSource({ source: 'byte', slug: 'deep-research' })
+      caller.installFromSource({ source: 'byte', slug: 'deep-research', signature: 'sig' })
     ).rejects.toMatchObject({ code: 'FORBIDDEN' });
     expect(installDispatchMock.__dispatchInstallFromSource).not.toHaveBeenCalled();
   });
@@ -1269,7 +1270,11 @@ describe('kiloclawRouter installFromSource', () => {
     });
     const caller = createCaller({ user });
 
-    const result = await caller.installFromSource({ source: 'byte', slug: 'deep-research' });
+    const result = await caller.installFromSource({
+      source: 'byte',
+      slug: 'deep-research',
+      signature: 'sig',
+    });
 
     expect(result).toEqual({
       ok: true,
@@ -1281,6 +1286,7 @@ describe('kiloclawRouter installFromSource', () => {
       userId: user.id,
       source: 'byte',
       slug: 'deep-research',
+      expectedSignature: 'sig',
     });
   });
 
@@ -1295,7 +1301,11 @@ describe('kiloclawRouter installFromSource', () => {
     });
     const caller = createCaller({ user });
 
-    const result = await caller.installFromSource({ source: 'byte', slug: 'deep-research' });
+    const result = await caller.installFromSource({
+      source: 'byte',
+      slug: 'deep-research',
+      signature: 'sig',
+    });
 
     expect(result).toEqual({ ok: false, code: 'no_instance' });
   });
@@ -1308,7 +1318,7 @@ describe('kiloclawRouter installFromSource', () => {
     const caller = createCaller({ user });
 
     await expect(
-      caller.installFromSource({ source: 'hacker', slug: 'deep-research' })
+      caller.installFromSource({ source: 'hacker', slug: 'deep-research', signature: 'sig' })
     ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
     expect(installDispatchMock.__dispatchInstallFromSource).not.toHaveBeenCalled();
   });
diff --git a/apps/web/src/routers/kiloclaw-router.ts b/apps/web/src/routers/kiloclaw-router.ts
index ae3b5587c2..fb9d536751 100644
--- a/apps/web/src/routers/kiloclaw-router.ts
+++ b/apps/web/src/routers/kiloclaw-router.ts
@@ -3044,6 +3044,9 @@ export const kiloclawRouter = createTRPCRouter({
       z.object({
         source: z.enum(INSTALL_SOURCE_KEYS),
         slug: z.string().min(1).max(200),
+        // Signature of the payload the user reviewed; the dispatch re-verifies
+        // and requires the re-fetched payload to still match this.
+        signature: z.string().min(1).max(200),
       })
     )
     .mutation(async ({ ctx, input }) => {
@@ -3051,6 +3054,7 @@ export const kiloclawRouter = createTRPCRouter({
         userId: ctx.user.id,
         source: input.source,
         slug: input.slug,
+        expectedSignature: input.signature,
       });
     }),
 

From da361d359d9c01d1f139673aa26ee5464cec1818 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 14:52:25 -0700
Subject: [PATCH 15/20] fix lint

---
 services/kilo-chat/src/routes/internal.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/kilo-chat/src/routes/internal.ts b/services/kilo-chat/src/routes/internal.ts
index b2f4c06a3e..160efec984 100644
--- a/services/kilo-chat/src/routes/internal.ts
+++ b/services/kilo-chat/src/routes/internal.ts
@@ -12,7 +12,7 @@ import { postMessageAsUser } from '../services/post-message-as-user';
  */
 export function registerInternalRoutes(app: Hono<{ Bindings: Env; Variables: AuthContext }>) {
   app.post('/internal/v1/post-message-as-user', async c => {
-    const raw = await c.req.json().catch(() => null);
+    const raw: unknown = await c.req.json().catch(() => null);
     const parsed = postMessageAsUserParamsSchema.safeParse(raw);
     if (!parsed.success) {
       return c.json({ ok: false, code: 'invalid_request', error: parsed.error.message }, 400);

From bff9cabd613bb29d3c7937cc343517c03cf4061f Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 15:06:59 -0700
Subject: [PATCH 16/20] fix kilobot findings

---
 apps/web/src/lib/kiloclaw/install-dispatch.test.ts | 1 -
 apps/web/src/lib/kiloclaw/install-dispatch.ts      | 4 ++--
 apps/web/src/lib/kiloclaw/install.ts               | 8 +++++++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
index a67efc37e8..c07c8934b7 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -91,7 +91,6 @@ describe('dispatchInstallFromSource', () => {
       sandboxId: RUNTIME_SANDBOX_ID, // NOT the registry row's sandboxId
       message: 'Research [topic] for me.',
       source: 'install',
-      autoCreateConversation: true,
       forceNewConversation: true, // each install gets its own conversation
       correlation: { reason: 'clawbyte:deep-research' },
     });
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index e232ad746c..c017d50b00 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -149,9 +149,9 @@ export async function dispatchInstallFromSource(
     sandboxId: runtimeSandboxId,
     message: payload.prompt,
     source: 'install',
-    autoCreateConversation: true,
     // Each install gets its own dedicated conversation rather than appending
-    // to whatever the user last chatted in.
+    // to whatever the user last chatted in. (`forceNewConversation` already
+    // implies creation, so `autoCreateConversation` is omitted as redundant.)
     forceNewConversation: true,
     correlation: { reason },
   });
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
index 77e9d79d8d..2821535126 100644
--- a/apps/web/src/lib/kiloclaw/install.ts
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -138,7 +138,13 @@ function verifySignedPayload(payload: InstallPayload): VerifyOk | VerifyErr {
  * Returns null on overflow (caller logs and rejects).
  */
 async function readBoundedText(res: Response, maxBytes: number): Promise<string | null> {
-  if (!res.body) return await res.text();
+  if (!res.body) {
+    // No streamable body (some Response shims / edge stubs). Still enforce the
+    // cap: buffer the whole body, then reject if it overflows.
+    const buf = await res.arrayBuffer();
+    if (buf.byteLength > maxBytes) return null;
+    return new TextDecoder('utf-8').decode(buf);
+  }
   const reader = res.body.getReader();
   const chunks: Uint8Array[] = [];
   let total = 0;

From 0f298486714a7b8a7a19819505cd9bce8af6ce17 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Mon, 1 Jun 2026 15:15:20 -0700
Subject: [PATCH 17/20] fix(kilo-chat): re-sync plugin shared schemas   after
 messageTextSchema

---
 packages/kilo-chat/src/schemas.ts                     |  4 ++--
 .../kiloclaw/plugins/kilo-chat/src/synced/schemas.ts  | 11 ++++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/packages/kilo-chat/src/schemas.ts b/packages/kilo-chat/src/schemas.ts
index 1efa357d83..bb4036bae5 100644
--- a/packages/kilo-chat/src/schemas.ts
+++ b/packages/kilo-chat/src/schemas.ts
@@ -43,8 +43,8 @@ export const conversationTitleSchema = trimmedNonEmptyString(CONVERSATION_TITLE_
  * Validation for a single message text body. Shared source of truth so every
  * boundary that accepts message text (the `textBlockSchema` used at message
  * creation, and the `postMessageAsUserParamsSchema` HTTP boundary) enforces
- * the SAME rule — trimmed, non-empty, ≤ MESSAGE_TEXT_MAX_CHARS — and cannot
- * drift apart.
+ * the SAME rule (trimmed, non-empty, max MESSAGE_TEXT_MAX_CHARS), so they
+ * cannot drift apart.
  */
 export const messageTextSchema = trimmedNonEmptyString(MESSAGE_TEXT_MAX_CHARS);
 
diff --git a/services/kiloclaw/plugins/kilo-chat/src/synced/schemas.ts b/services/kiloclaw/plugins/kilo-chat/src/synced/schemas.ts
index 35d7cb0c18..bb4036bae5 100644
--- a/services/kiloclaw/plugins/kilo-chat/src/synced/schemas.ts
+++ b/services/kiloclaw/plugins/kilo-chat/src/synced/schemas.ts
@@ -39,6 +39,15 @@ const trimmedNonEmptyString = (max: number) =>
 
 export const conversationTitleSchema = trimmedNonEmptyString(CONVERSATION_TITLE_MAX_CHARS);
 
+/**
+ * Validation for a single message text body. Shared source of truth so every
+ * boundary that accepts message text (the `textBlockSchema` used at message
+ * creation, and the `postMessageAsUserParamsSchema` HTTP boundary) enforces
+ * the SAME rule (trimmed, non-empty, max MESSAGE_TEXT_MAX_CHARS), so they
+ * cannot drift apart.
+ */
+export const messageTextSchema = trimmedNonEmptyString(MESSAGE_TEXT_MAX_CHARS);
+
 // 1-64 bytes UTF-8, no C0 (0x00-0x1F) or C1 (0x7F-0x9F) control chars.
 export const emojiSchema = z
   .string()
@@ -90,7 +99,7 @@ export const actionsBlockSchema = z
 
 export const textBlockSchema = z.object({
   type: z.literal('text'),
-  text: trimmedNonEmptyString(MESSAGE_TEXT_MAX_CHARS),
+  text: messageTextSchema,
 });
 
 const attachmentMetadataShape = {

From 7c77b0d6ae2e0f9e7e02d74266044359d5f7ceae Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Tue, 2 Jun 2026 06:45:23 -0700
Subject: [PATCH 18/20] fixes

---
 .../install/[source]/[slug]/InstallClient.tsx |  6 +++--
 .../components/icons/KiloClawbsterIcon.tsx    |  9 +++++++-
 .../src/lib/kiloclaw/install-dispatch.test.ts | 23 +++++++++++++++++++
 apps/web/src/lib/kiloclaw/install-dispatch.ts | 12 ++++++++++
 .../lib/kiloclaw/kilo-chat-internal-client.ts |  5 ++++
 5 files changed, 52 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
index e558686ed6..9024b0d6e2 100644
--- a/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
+++ b/apps/web/src/app/(app)/claw/install/[source]/[slug]/InstallClient.tsx
@@ -89,7 +89,7 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
             <KiloClawbsterIcon className="h-4 w-auto" />
             {sourceLabel}
           </Badge>
-          <CardTitle className="mt-2 text-xl">{payload.title}</CardTitle>
+          <CardTitle className="mt-2 text-xl break-words">{payload.title}</CardTitle>
           <CardDescription className="leading-relaxed">
             You’re installing a {sourceLabel} from kilo.ai. Clicking Confirm Install starts a new
             KiloClaw conversation and runs its prompt on your behalf. If you don’t want to install
@@ -100,7 +100,9 @@ export function InstallClient({ source, sourceLabel, payload }: InstallClientPro
           <p className="text-muted-foreground text-sm font-medium">
             This {sourceLabel} installs a skill to:
           </p>
-          <p className="text-foreground mt-2 text-sm leading-relaxed">{payload.description}</p>
+          <p className="text-foreground mt-2 text-sm leading-relaxed break-words">
+            {payload.description}
+          </p>
         </CardContent>
         <CardFooter className="justify-end gap-3">
           <Button
diff --git a/apps/web/src/components/icons/KiloClawbsterIcon.tsx b/apps/web/src/components/icons/KiloClawbsterIcon.tsx
index 9dee829dc8..6c57522fb9 100644
--- a/apps/web/src/components/icons/KiloClawbsterIcon.tsx
+++ b/apps/web/src/components/icons/KiloClawbsterIcon.tsx
@@ -1,6 +1,13 @@
 export default function KiloClawbsterIcon({ className }: { className?: string }) {
   return (
-    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 134 164" fill="none" className={className}>
+    <svg
+      xmlns="http://www.w3.org/2000/svg"
+      viewBox="0 0 134 164"
+      fill="none"
+      className={className}
+      aria-hidden="true"
+      focusable="false"
+    >
       <path
         fill="#000"
         d="M10.89 5.145c.22-.338 2.345-1.772 2.805-2.04 2.827-1.649 5.748-3.203 9.11-3.1 1.797.637 2.073 1.396 2.19 3.285-.242.686-.88 2.59-1.267 3.094A40 40 0 0 0 22.6 9.348c-.149 1.443.43 4.84.204 5.353-1.546 3.509-2.119 2.985-.411 6.777.314.696-.366 4.188.197 4.99.417-.168 1.572-2.195 1.836-2.716.732-1.442.25-3.182.508-4.642.238-1.35 1.467-2.613 1.494-4.089.463-2.104-1.78-6.035.326-7.441.426-.285 1.492-.117 1.914.11 7.966 4.302 10.085 18.334 7.049 25.913.917 1.7 1.193 1.639 1.618 3.59.072.785.263 2.463.111 3.169a21.4 21.4 0 0 1-4.542 12.613c2.332 1.327 3.62 4.196 4.788 6.539 3.002-.268 3.973 2.493 5.908 4.46 1.297 1.318 1.763 1.733 3.245 2.772 2.676-11.471 6.812-20.733 12.907-30.738-.286-1.305-.492-2.659-.833-3.945-2.121-8.052-5.471-15.812-10.42-22.533A57 57 0 0 0 45.5 5.826c-.744-.842-3.113-2.765-2.79-3.892.969-.352 2.562 1.232 3.237 1.848 4.72 4.316 7.626 9.564 10.516 15.159.112.241.343.79.49.98.776 2.187 1.741 4.098 2.506 6.448.72 2.213 1.25 4.983 1.952 6.973.34.194.712.066 1.2.031.434.176.666.497.993.846.404-1.46 1.375-4.822 2.569-5.62 1.742-1.162 3.03 4.426 3.53 5.3 1.143-.33.577-.867 2.136-.39.423-.668 1.544-5.657 1.954-6.857 3.034-8.867 7.537-17.634 14.703-23.867.595-.517 1.718-1.366 2.35-.57-.26.786-5.106 6.076-6.107 7.465-5.795 8.04-9.22 16.765-11.15 26.398 5.664 9.381 10.726 19.91 12.873 30.741 2.722-1.95 4.088-3.856 6.265-6.293.8-.896 1.774-1.077 2.935-1.005 1.322-2.577 2.379-5.023 4.867-6.575-1.947-2.176-3.405-5.743-4.056-8.602-.547-2.403-.881-6.152-.043-8.565.112-.323 1.068-1.832 1.299-2.2-2.898-7.36-1.017-20.711 5.923-25.304 2.776-1.592 4.494-.742 3.807 2.594-.118 1.647-.859 3.83-.146 5.623.346.87 1.039 1.875 1.165 2.805.185 1.35-.125 3.02.483 4.31.276.587 1.383 2.687 1.923 2.9l.17-.162c.166-1.079-.288-2.644.003-4.3.025-1.107 1.19-2.96 1.087-3.943-.297-1.297-1.273-2.155-1.548-3.492-.312-1.519.451-3.048.33-4.52-.169-2.057-1.614-3.952-2.226-5.884-.47-1.48-.282-3.731 1.58-4.093 3.564-.593 7.689 1.922 10.582 3.742l.75.535c6.512 5.232 10.462 11.708 11.487 20.131.246 2.019.389 5.406.104 7.41-.045.9-.14 1.764-.235 2.658-1.851 10.357-7.432 21.306-17.659 25.639-.799.338-1.695.549-2.423 1.022l.016.161c.118 1.41-.153 2.487-1.107 3.569-1.497 1.697-4.571 3.353-6.698 4.057-.416 1.835-.674 2.28-2.322 3.304-4.63 2.875-8.072 4.628-13.201 6.296.067 1.06.165 2.302.17 3.36 2.531-.454 4.034-1.061 6.492-1.818 1.974-.6 5.685-2.164 7.563-1.465 1.262-1.506 3.102-2.704 4.5-4.178 2.572-2.713 4.617-5.994 7.337-8.542 1.83-1.714 4.415-.967 4.329 1.687-.046 2.339-1.076 4.733-2.404 6.596-.342.497-.987 1.492-1.353 1.908-2.769 3.496-5.933 6.282-10.036 8.142-.81.366-1.64 1.116-2.512 1.407-4.826 1.608-8.771 2.273-13.815 2.707l-.046.763-.047.764c4.427-.458 7.8-1.072 12.168-2 1.627-.346 2.986-.096 4.557.293 2.843.41 5.097.96 7.717 2.247.717.392 1.981 1.109 2.597 1.597 3.267 2.028 6.446 4.958 7.663 8.733.766 2.381-1.761 3.635-3.818 2.28-3.572-2.356-6.825-5.137-10.759-6.936-1.158-.526-2.565-1.085-3.656-1.717-2.752 1.73-14.72.446-17.72.946 2.168.394 13.568.96 15.732 1.44.447.097 1.472.317 1.736.69.687.969 1.925 1.13 2.847 1.815 2.217 1.692 4.503 4.395 6.081 6.689 1.876 2.728 4.177 6.95 3.721 10.348-.288 2.144-2.772 2.312-4.128.77-1.816-2.064-3.251-4.253-4.881-6.45-1.71-2.237-3.378-4.601-5.222-6.728-1.812.432-15.44-3.712-17.386-4.074.951.414 14.33 4.721 14.701 5.737.464 1.316 1.827 2.25 2.348 3.568 2.195 5.551 4.294 12.455 1.99 18.264-.52 1.315-2.099 1.585-3.203.87-.686-.446-.93-1.492-1.212-2.226-.719-2.48-1.124-5.13-1.717-7.647-.484-2.057-1.173-4.035-1.613-6.112-.291-1.306-.164-1.173-1.434-1.632-3.28-1.085-9.262-4.237-12.307-5.96-.35.355-.717.715-1.058 1.078.984 2.88 1.575 6.34-.251 9.002 1.113 3.177 1.495 7.775-1.045 10.4.807 3.278.449 7.172-2.226 9.52.18 1.923.126 2.684-.285 4.566 2.85.431 6.558 1.553 9.02 3.01l.708.37c2.193 1.352 4.171 2.996 4.807 5.616a6.3 6.3 0 0 1-.75 4.808c-1.711 2.765-4.677 3.715-7.772 3.486-.57 1.718-1.284 3.269-3.019 4.127a10 10 0 0 1-.71.304c-.487.269-.57.303-1.114.419q-.466.132-.94.217c-2.305.424-5.028-.214-6.945-1.547q-.541.65-1.193 1.186c-1.71 1.388-3.712 2.075-5.918 1.838a8.08 8.08 0 0 1-5.331-2.929c-.638.364-1.332.775-2.033.987-4.833 1.458-9.085.31-10.75-4.593-2.148.085-3.505.06-5.424-1.12-1.447-.885-2.883-2.65-3.167-4.37-1.285-7.775 8.935-10.661 14.594-11.871-.47-1.825-.51-2.657-.305-4.527-2.679-2.477-2.932-6.137-2.139-9.505-2.878-3.062-2.084-6.913-1.146-10.611-1.737-1.666-1.265-6.94-.156-8.695l-1.22-1.214c-2.561 1.617-10.498 5.715-13.339 6.329-.51 2.551-1.497 5.561-2.094 8.165-.634 2.766-1.096 5.993-2.197 8.554l-.34.412c-1.456 1.103-3.057.56-3.6-1.13-1.796-5.579-.17-12.241 1.97-17.517.635-1.562 1.94-2.487 2.578-4.06.384-.947 13.345-5.267 14.237-5.567-1.992.32-15.165 4.402-17.011 4.065-3.13 3.772-5.916 7.799-8.817 11.74-.835 1.059-1.712 2.364-3.175 2.509-1.357.135-2.222-1.121-2.258-2.35-.125-4.198 2.773-8.829 5.39-11.934.78-1.055 1.662-1.978 2.59-2.899 1.638-1.918 3.577-2.228 4.845-3.757 1.908-.742 15.115-1.626 17.436-1.874-3 0-15.23.726-17.723-.931-.68.343-1.462.694-2.16.975-4.212 1.69-7.716 4.394-11.337 7.047-1.742 1.276-4.49 2.138-4.906-.859-.213-1.531 1.731-4.239 2.686-5.343a23.2 23.2 0 0 1 15.835-7.93c.583-.43 1.022-.69 1.764-.644 2.622.163 5.24.84 7.832 1.283 2.534.433 4.457.643 7.009.902v-1.5c-5.286-.466-9.935-1.252-14.992-2.916-.46-.152-1.134-1.029-1.784-1.287-2.794-1.108-5.264-2.985-7.416-5.06-2.915-2.878-6.362-7.533-6.436-11.746.008-.686.398-1.45.91-1.883 1.51-1.273 3.267.187 4.343 1.31.856.893 1.645 1.87 2.397 2.868.576.698 1.295 1.525 1.805 2.255.955 1.027 1.911 2.22 2.899 3.192 1.246 1.227 2.622 2.412 3.913 3.61.391-.166 1.14-.383 1.543-.274 4.502 1.227 7.754 2.538 12.33 3.54.158-1.002.232-2.316.319-3.347-5.151-1.67-9.179-3.657-13.742-6.727-1.17-.787-1.61-1.566-1.815-2.904-2.187-.793-4.99-2.383-6.641-4.01-1.313-1.294-1.107-2.024-1.088-3.736-.706-.493-1.919-.757-2.727-1.124-2.473-1.153-4.737-2.642-6.733-4.53C2.38 47.405-1.54 34.04.553 22.333c.786-4.4 3.57-10.33 6.56-13.558 1.062-1.31 2.466-2.587 3.777-3.631"
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
index c07c8934b7..532a9b2e5b 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -30,6 +30,7 @@ function makeDeps(
     fetchInstallPayload: overrides.fetchInstallPayload ?? (async () => VALID_PAYLOAD),
     getActiveInstance: overrides.getActiveInstance ?? (async () => ACTIVE_INSTANCE),
     resolveRuntimeSandboxId: overrides.resolveRuntimeSandboxId ?? (async () => RUNTIME_SANDBOX_ID),
+    requireKiloClawAccessAtInstance: overrides.requireKiloClawAccessAtInstance ?? (async () => {}),
     postMessageAsUser:
       overrides.postMessageAsUser ??
       (async () =>
@@ -149,6 +150,28 @@ describe('dispatchInstallFromSource', () => {
     expect(dispatchSpy).not.toHaveBeenCalled();
   });
 
+  it('fails closed (and does NOT dispatch) when the resolved instance is not entitled', async () => {
+    // clawAccessProcedure passed, but the resolved instance is not entitled
+    // (inconsistent billing anchor). The per-instance check throws.
+    const dispatchSpy = jest.fn();
+    const resolveSpy = jest.fn(async () => RUNTIME_SANDBOX_ID);
+    await expect(
+      dispatchInstallFromSource(
+        ARGS,
+        makeDeps({
+          requireKiloClawAccessAtInstance: async () => {
+            throw new TRPCError({ code: 'FORBIDDEN', message: 'not entitled' });
+          },
+          resolveRuntimeSandboxId: resolveSpy,
+          postMessageAsUser: dispatchSpy as never,
+        })
+      )
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    // Refused before resolving the sandbox or dispatching.
+    expect(resolveSpy).not.toHaveBeenCalled();
+    expect(dispatchSpy).not.toHaveBeenCalled();
+  });
+
   it('uses the runtime sandbox id, not the registry row, to dispatch', async () => {
     jest.spyOn(console, 'info').mockImplementation(() => {});
 
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index c017d50b00..581d49e36a 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -2,6 +2,7 @@ import 'server-only';
 import { TRPCError } from '@trpc/server';
 import { fetchInstallPayload } from './install';
 import type { InstallSource } from './install-sources';
+import { requireKiloClawAccessAtInstance } from './access-gate';
 import {
   getActiveInstance,
   workerInstanceId,
@@ -63,6 +64,7 @@ export type DispatchInstallFromSourceDeps = {
     userId: string,
     instance: ActiveKiloClawInstance
   ) => Promise<string | null>;
+  requireKiloClawAccessAtInstance: typeof requireKiloClawAccessAtInstance;
   postMessageAsUser: typeof postMessageAsUser;
 };
 
@@ -90,6 +92,7 @@ const defaultDeps: DispatchInstallFromSourceDeps = {
   fetchInstallPayload,
   getActiveInstance,
   resolveRuntimeSandboxId: defaultResolveRuntimeSandboxId,
+  requireKiloClawAccessAtInstance,
   postMessageAsUser,
 };
 
@@ -126,6 +129,15 @@ export async function dispatchInstallFromSource(
     return { ok: false, code: 'no_instance' };
   }
 
+  // Bind entitlement to THIS exact instance. The `clawAccessProcedure` gate
+  // only proves the user has some active access; in an inconsistent billing
+  // state (e.g. the current subscription anchored to a different/destroyed row
+  // while an orphaned active instance remains) that gate can pass while the
+  // resolved instance is not entitled. Re-check access for the resolved
+  // instance and fail closed, so a prompt is never dispatched into an
+  // unentitled runtime. Throws TRPCError FORBIDDEN/NOT_FOUND on mismatch.
+  await deps.requireKiloClawAccessAtInstance(userId, instance.id);
+
   // Use the runtime sandbox id (not the registry row's `sandboxId`) so
   // half-migrated rows don't dispatch into a stale conversation. See
   // `defaultResolveRuntimeSandboxId` for the why.
diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
index 54d7f1b98f..2c0b12023f 100644
--- a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
@@ -64,6 +64,11 @@ export async function postMessageAsUser(
       body: JSON.stringify(params),
       // Internal-only call between services; no caching.
       cache: 'no-store',
+      // Never follow redirects on a request that carries the internal API key:
+      // a misconfigured or redirecting destination must not be able to forward
+      // the secret (and the prompt) to another origin. A redirect fails here
+      // and surfaces as a typed `internal` result below.
+      redirect: 'error',
       signal: AbortSignal.timeout(POST_MESSAGE_AS_USER_TIMEOUT_MS),
     });
   } catch (err) {

From c7f44bf170b0569de101d7b3346ec5aa41b59b18 Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Tue, 2 Jun 2026 07:16:59 -0700
Subject: [PATCH 19/20]   getKiloChatBaseUrl() now parses the resolved URL and,
 if the origin isn't   allowed, throws before the key is attached

---
 .../kilo-chat-internal-client.test.ts         | 18 ++++++++--
 .../lib/kiloclaw/kilo-chat-internal-client.ts | 35 +++++++++++++++----
 2 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
index 583eb5d1aa..aee4101901 100644
--- a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.test.ts
@@ -1,6 +1,6 @@
 // Env must be set BEFORE importing the module under test so its constants
 // resolve to the test values.
-process.env.NEXT_PUBLIC_KILO_CHAT_URL = 'https://kilo-chat.test.example.com';
+process.env.NEXT_PUBLIC_KILO_CHAT_URL = 'https://chat.kiloapps.io';
 
 jest.mock('@/lib/config.server', () => ({
   INTERNAL_API_SECRET: 'test-internal-secret',
@@ -48,7 +48,7 @@ describe('postMessageAsUser (cloud → kilo-chat internal HTTP)', () => {
 
     expect(fetchSpy).toHaveBeenCalledTimes(1);
     const [url, init] = fetchSpy.mock.calls[0]!;
-    expect(url).toBe('https://kilo-chat.test.example.com/internal/v1/post-message-as-user');
+    expect(url).toBe('https://chat.kiloapps.io/internal/v1/post-message-as-user');
     expect(init?.method).toBe('POST');
     const headers = init?.headers as Record<string, string>;
     expect(headers['x-internal-api-key']).toBe('test-internal-secret');
@@ -125,6 +125,20 @@ describe('postMessageAsUser (cloud → kilo-chat internal HTTP)', () => {
     }
   });
 
+  it('refuses to send the key to an off-allowlist origin (never fetches)', async () => {
+    const saved = process.env.NEXT_PUBLIC_KILO_CHAT_URL;
+    process.env.NEXT_PUBLIC_KILO_CHAT_URL = 'https://evil.example.com';
+    const fetchSpy = jest.spyOn(global, 'fetch');
+    try {
+      await expect(postMessageAsUser(VALID_PARAMS)).rejects.toThrow(
+        /not an allowed kilo-chat origin/
+      );
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally {
+      process.env.NEXT_PUBLIC_KILO_CHAT_URL = saved;
+    }
+  });
+
   it('returns a typed internal error when the request times out', async () => {
     // Simulate AbortSignal.timeout firing by having fetch reject with a
     // TimeoutError-named exception (which is what the browser/node fetch
diff --git a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
index 2c0b12023f..fd41c8ffd3 100644
--- a/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
+++ b/apps/web/src/lib/kiloclaw/kilo-chat-internal-client.ts
@@ -28,16 +28,39 @@ const POST_MESSAGE_AS_USER_TIMEOUT_MS = 5_000;
  *   binding. Already used by other cloud → service integrations.
  */
 
+// Origins the internal API key may be sent to. The destination comes from
+// NEXT_PUBLIC_KILO_CHAT_URL (deploy config), so this is defense in depth: a
+// misconfigured or tampered value must not be able to forward the key (and the
+// prompt) to an unexpected host. `chat.kiloapps.io` is the single deployed
+// kilo-chat origin (services/kilo-chat/wrangler.jsonc). Loopback covers local
+// dev on any port (KILO_PORT_OFFSET can shift it). Add new deployed origins
+// here if kilo-chat ever gains a staging domain.
+function isAllowedKiloChatOrigin(url: URL): boolean {
+  if (url.protocol === 'https:' && url.hostname === 'chat.kiloapps.io') return true;
+  if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') return true;
+  return false;
+}
+
 function getKiloChatBaseUrl(): string {
-  // We deliberately read process.env directly here rather than importing
-  // KILO_CHAT_URL from `@/lib/constants` — the constants file marks it as a
-  // *required* env var at import time, which causes test setups to crash if
-  // the var isn't set. This server-only client should fail loudly only when
-  // it's actually called.
+  // Read process.env directly rather than importing KILO_CHAT_URL from
+  // `@/lib/constants`: that constant is marked required at import time, which
+  // crashes test setups if the var is unset. This server-only client should
+  // fail loudly only when it is actually called.
   const raw = process.env.NEXT_PUBLIC_KILO_CHAT_URL;
   if (!raw) {
     throw new Error(
-      'NEXT_PUBLIC_KILO_CHAT_URL is not configured — cannot reach kilo-chat internal routes'
+      'NEXT_PUBLIC_KILO_CHAT_URL is not configured, cannot reach kilo-chat internal routes'
+    );
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`NEXT_PUBLIC_KILO_CHAT_URL is not a valid URL: ${raw}`);
+  }
+  if (!isAllowedKiloChatOrigin(parsed)) {
+    throw new Error(
+      `Refusing to send the internal API key: ${parsed.origin} is not an allowed kilo-chat origin`
     );
   }
   return raw.replace(/\/$/, '');

From e04e826b6d7d6392b24b964f3799f99d3fd9eefa Mon Sep 17 00:00:00 2001
From: St0rmz1 <astorms@replicated.com>
Date: Tue, 2 Jun 2026 07:48:40 -0700
Subject: [PATCH 20/20] fix cache undermining the signature binding

---
 .../src/lib/kiloclaw/install-dispatch.test.ts  |  3 ++-
 apps/web/src/lib/kiloclaw/install-dispatch.ts  |  5 ++++-
 apps/web/src/lib/kiloclaw/install.test.ts      | 16 ++++++++++++++++
 apps/web/src/lib/kiloclaw/install.ts           | 18 ++++++++++++++----
 4 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
index 532a9b2e5b..fde09f4015 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.test.ts
@@ -85,7 +85,8 @@ describe('dispatchInstallFromSource', () => {
       conversationCreated: true,
     });
 
-    expect(fetchSpy).toHaveBeenCalledWith('byte', 'deep-research');
+    // Dispatch re-fetches uncached so a changed/revoked/deleted byte is seen.
+    expect(fetchSpy).toHaveBeenCalledWith('byte', 'deep-research', { bypassCache: true });
     expect(instanceSpy).toHaveBeenCalledWith('user-1');
     expect(dispatchSpy).toHaveBeenCalledWith({
       userId: 'user-1',
diff --git a/apps/web/src/lib/kiloclaw/install-dispatch.ts b/apps/web/src/lib/kiloclaw/install-dispatch.ts
index 581d49e36a..a494e0e0e8 100644
--- a/apps/web/src/lib/kiloclaw/install-dispatch.ts
+++ b/apps/web/src/lib/kiloclaw/install-dispatch.ts
@@ -102,7 +102,10 @@ export async function dispatchInstallFromSource(
 ): Promise<DispatchInstallFromSourceResult> {
   const { userId, source, slug, expectedSignature } = args;
 
-  const payload = await deps.fetchInstallPayload(source, slug);
+  // Uncached read: this is the confirm-time dispatch, so a byte changed,
+  // revoked, or deleted since the preview rendered must be seen now (a stale
+  // cached payload would still match the reviewed signature and dispatch).
+  const payload = await deps.fetchInstallPayload(source, slug, { bypassCache: true });
   if (!payload) {
     throw new TRPCError({
       code: 'NOT_FOUND',
diff --git a/apps/web/src/lib/kiloclaw/install.test.ts b/apps/web/src/lib/kiloclaw/install.test.ts
index b742ede9e3..91c3579daf 100644
--- a/apps/web/src/lib/kiloclaw/install.test.ts
+++ b/apps/web/src/lib/kiloclaw/install.test.ts
@@ -83,6 +83,22 @@ describe('fetchInstallPayload', () => {
     expect(result?.signatureKeyId).toBe(EXPECTED_KID);
   });
 
+  it('reads cached by default and uncached when bypassCache is set', async () => {
+    const signed = signPayload(VALID_BASE);
+    // Fresh Response per call: a single Response body can only be read once.
+    const fetchSpy = jest
+      .spyOn(global, 'fetch')
+      .mockImplementation(async () => jsonResponse(signed));
+
+    await fetchInstallPayload('byte', 'deep-research');
+    await fetchInstallPayload('byte', 'deep-research', { bypassCache: true });
+
+    // Preview: short revalidate window. Dispatch: no-store, so a changed or
+    // revoked byte is seen immediately rather than served from cache.
+    expect(fetchSpy.mock.calls[0]![1]).toMatchObject({ next: { revalidate: 300 } });
+    expect(fetchSpy.mock.calls[1]![1]).toMatchObject({ cache: 'no-store' });
+  });
+
   it('returns null when upstream is 404', async () => {
     jest.spyOn(global, 'fetch').mockResolvedValue(new Response(null, { status: 404 }));
     const result = await fetchInstallPayload('byte', 'missing-slug');
diff --git a/apps/web/src/lib/kiloclaw/install.ts b/apps/web/src/lib/kiloclaw/install.ts
index 2821535126..3f9a7d964c 100644
--- a/apps/web/src/lib/kiloclaw/install.ts
+++ b/apps/web/src/lib/kiloclaw/install.ts
@@ -178,18 +178,28 @@ async function readBoundedText(res: Response, maxBytes: number): Promise<string
 
 export async function fetchInstallPayload(
   source: InstallSource,
-  slug: string
+  slug: string,
+  opts: { bypassCache?: boolean } = {}
 ): Promise<InstallPayload | null> {
   const url = INSTALL_SOURCES[source].urlTemplate.replace('{slug}', encodeURIComponent(slug));
-  // `redirect: 'error'` is SSRF defense-in-depth: the host comes from the
+  // `redirect: 'error'` is SSRF defense in depth: the host comes from the
   // registry (not user input) and the slug is encoded into a single path
   // segment, so a request can't target an off-registry origin directly. The
-  // one residual path would be the trusted origin itself answering 3xx →
+  // one residual path would be the trusted origin itself answering 3xx to an
   // attacker host; refusing to follow redirects closes that before the
   // signature check even runs. A redirect now rejects (caught below).
+  //
+  // Caching: the preview render uses a short revalidate window so repeated
+  // page loads are cheap. The CONFIRM-TIME dispatch passes `bypassCache` for an
+  // uncached read, so a byte that was changed, revoked, or deleted upstream
+  // takes effect immediately (a stale cached payload would otherwise still
+  // match the reviewed signature and dispatch within the revalidate window).
+  const fetchInit: RequestInit = opts.bypassCache
+    ? { cache: 'no-store', redirect: 'error' }
+    : { next: { revalidate: 300 }, redirect: 'error' };
   let res: Response;
   try {
-    res = await fetch(url, { next: { revalidate: 300 }, redirect: 'error' });
+    res = await fetch(url, fetchInit);
   } catch (err) {
     throw new Error(
       `fetchInstallPayload(${source}, ${slug}): request failed (redirects are not followed): ${err instanceof Error ? err.message : String(err)}`