(janitor/dedupe): consolidate Kilo v3 token signing onto signKiloToken

[kilo-code-bot]

Summary

webhook-agent-ingest, security-auto-analysis, and gastown each hand-rolled
their own HS256 "Kilo user token v3" JWT signer instead of using the canonical
signKiloToken() already exported from @kilocode/worker-utils:

• services/webhook-agent-ingest/src/util/jwt.ts — a hand-rolled base64url +
  Web Crypto HMAC-SHA256 signer, used only by token-minting-service.ts.
• services/security-auto-analysis/src/token.ts — a near byte-identical
  hand-rolled implementation of the same base64url/HMAC signer.
• services/gastown/src/util/kilo-token.util.ts — a third variant calling
  jose's SignJWT directly.

All three produce the same "Kilo user token v3" shape (kiloUserId,
apiTokenPepper, version: 3, plus optional extras like botId /
internalApiUse / createdOnPlatform) that signKiloToken() in
packages/worker-utils/src/kilo-token.ts already owns, and all three services
already depend on @kilocode/worker-utils and run in the same Cloudflare
Workers runtime as the canonical implementation — no cross-runtime coupling.

Today a bug fix, claim change, or hardening applied to the canonical
implementation would silently not propagate to these three independent
copies of the same security-sensitive signing logic.

Changes

• webhook-agent-ingest: delete util/jwt.ts entirely;
  token-minting-service.ts now calls signKiloToken.
• security-auto-analysis: delete the local signJwt /
  parseExpiresIn / hmacSha256 / base64url helpers from token.ts;
  generateApiToken and generateInternalServiceToken now delegate to
  signKiloToken.
• gastown: kilo-token.util.ts's generateKiloApiToken now delegates to
  signKiloToken instead of calling jose's SignJWT directly.
• worker-utils: made signKiloToken's pepper param optional. Omitting
  it produces a token with no apiTokenPepper claim at all, matching the
  "internal service token" contract already documented and relied on by
  verifyKiloBearerAgainstCurrentPepper (an explicit null pepper is
  compared against the account's current pepper; an absent claim skips
  that check). This preserves generateInternalServiceToken's original
  behavior — it never included the claim — and is a purely additive,
  backward-compatible change (every other caller still passes a pepper
  explicitly). Added a regression test covering this in
  kilo-token.test.ts.

No behavior change for any other call site: they already always included
apiTokenPepper (string or null).

Verification

• pnpm --filter @kilocode/worker-utils typecheck / test — 28 files, 356
  tests passed (including a new test asserting the omitted-pepper claim
  behavior).
• pnpm --filter cloudflare-webhook-agent-ingest typecheck / test — 10
  files, 89 tests passed.
• pnpm --filter cloudflare-security-auto-analysis typecheck / test — 16
  files, 180 tests passed.
• pnpm --filter cloudflare-gastown typecheck / test — 22 files, 316 tests
  passed.
• oxlint / oxfmt on all changed files — clean.

Shared PostgreSQL/Redis were not started for this change; none of the touched
tests require them (pure unit-level JWT signing/verification).

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• packages/worker-utils/src/kilo-token.ts
• packages/worker-utils/src/kilo-token.test.ts

Previous Review Summary (commit dc28df9)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit dc28df9)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• packages/worker-utils/src/kilo-token.ts
• packages/worker-utils/src/kilo-token.test.ts
• services/gastown/src/util/kilo-token.util.ts
• services/security-auto-analysis/src/token.ts
• services/webhook-agent-ingest/src/services/token-minting-service.ts
• services/webhook-agent-ingest/src/util/jwt.ts

---

_{Reviewed by grok-4.6 · Input: 37.9K · Output: 5.8K · Cached: 189.2K}

_{Review guidance: REVIEW.md from base branch main}