feat(cloud-agent): add live session updates to sidebar

[eshurakov]

Summary

• Route Cloud Agent session lifecycle updates through the session-ingest worker and Durable Object so active sessions and sidebar state update from semantic live events instead of relying on polling alone.
• Introduce a shared UserWebConnection architecture for web and mobile clients, with retained ownership, stable viewer identity, session subscriptions, reconnect recovery, and ping/pong liveness handling.
• Preserve enriched sidebar/session cache data while merging live state changes, and use an app-scoped mobile connection that repairs subscriptions across foreground and network transitions.
• Add local WebSocket endpoint configuration and coverage for ordering, replacement connections, protocol handling, cache merging, lifecycle recovery, and routing behavior.

Verification

• Manually verified the Cloud Agent live-session update and connection lifecycle behavior locally.

Visual Changes

N/A

Reviewer Notes

• Focus review on session event ordering and cache merging in the web sidebar/active-session flows, where live data must not erase existing metadata.
• The connection model changes intentionally centralize /api/user/web ownership: web keeps one provider-scoped viewer socket and mobile uses one app-scoped retained connection with lifecycle recovery.
• The ingest Durable Object now treats viewer identity and liveness as protocol concerns, replacing stale sockets sharing a viewer connectionId and responding to ping messages.

[kilo-code-bot]

Code Review Summary

Status: 3 Issues Found (unchanged) | Recommendation: Address before merge

Executive Summary

The incremental diff (3 files: routes/api.ts, session-ingest-rpc.ts, test/schema additions) eliminates the follow-up SELECT after INSERT by using .returning() cleanly — no new issues found. The 3 previously identified warnings in unchanged files remain open.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
services/session-ingest/src/session-events.ts	67	Floating promise when ctx is absent — DO notification silently dropped at Worker boundary
apps/web/src/lib/cloud-agent-sdk/cli-live-transport.ts	64	cli.disconnected silently ignored when ownerConnectionId is null — breaks early-disconnect edge case
apps/web/src/components/cloud-agent-next/hooks/useActiveSessions.ts	96	Unbounded pendingLiveUpdate promise chain — potential memory leak under high event throughput

Incremental Changes Reviewed (commit 96b2f7e → HEAD)

Files changed since previous review commit 96b2f7eaa:

• services/session-ingest/src/routes/api.ts — no new issues
• services/session-ingest/src/routes/api.test.ts — no new issues
• services/session-ingest/src/session-ingest-rpc.ts — no new issues
• services/session-ingest/src/types/user-connection-protocol.ts — no new issues
• services/session-ingest/src/types/user-connection-protocol.test.ts — no new issues

Notes on new code:

• POST /session in api.ts now correctly uses .returning() directly on the INSERT, eliminating the follow-up SELECT — clean perf improvement with correct idempotency (ON CONFLICT DO NOTHING returns nothing on duplicate, no event fired).
• notifyUserSessionEventFromContext helper in api.ts properly passes executionCtx when available, using a try/catch for the test-context case where c.executionCtx throws. This is the correct pattern for the Hono+Worker boundary.
• createSessionForCloudAgent in session-ingest-rpc.ts similarly eliminates its follow-up SELECT via .returning().
• New SessionEventPayloadSchema and supporting Zod schemas in user-connection-protocol.ts are well-structured with good test coverage. The SessionStatusUpdatedPayloadSchema dual-branch union is correctly documented as temporary rollout compatibility.
• Ping/pong message types added to WebOutbound/WebInbound schemas with nonce: z.string() (required, preventing unintentional pong handling).

All Files Reviewed (27 files)

• apps/mobile/src/app/(app)/_layout.tsx
• apps/mobile/src/components/agents/mobile-session-manager.test.ts
• apps/mobile/src/components/agents/mobile-session-manager.ts
• apps/mobile/src/components/agents/session-provider.tsx
• apps/mobile/src/components/agents/user-web-connection-provider.tsx
• apps/mobile/src/lib/user-web-connection-lifecycle.test.ts
• apps/mobile/src/lib/user-web-connection-lifecycle.ts
• apps/web/src/components/cloud-agent-next/CloudAgentProvider.tsx
• apps/web/src/components/cloud-agent-next/CloudSidebarLayout.tsx
• apps/web/src/components/cloud-agent-next/hooks/useActiveSessions.test.ts
• apps/web/src/components/cloud-agent-next/hooks/useActiveSessions.ts — 1 issue
• apps/web/src/components/cloud-agent-next/hooks/useSidebarSessions.test.ts
• apps/web/src/components/cloud-agent-next/hooks/useSidebarSessions.ts
• apps/web/src/lib/cloud-agent-sdk/base-connection.ts
• apps/web/src/lib/cloud-agent-sdk/cli-live-transport.ts — 1 issue
• apps/web/src/lib/cloud-agent-sdk/user-web-connection.ts
• services/session-ingest/src/dos/UserConnectionDO.ts
• services/session-ingest/src/queue-consumer.ts
• services/session-ingest/src/routes/api.ts
• services/session-ingest/src/routes/api.test.ts
• services/session-ingest/src/session-events.ts — 1 issue
• services/session-ingest/src/session-ingest-rpc.ts
• services/session-ingest/src/types/user-connection-protocol.ts
• services/session-ingest/src/types/user-connection-protocol.test.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-4.6 · 1,008,676 tokens}

_{Review guidance: REVIEW.md from base branch main}