feat(session-ingest): relay compatible instance metadata safely - #5666
Merged
Conversation
6 tasks
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryReviewed the session-ingest instance-metadata protocol, attachment-capacity retry, native Workers regression, and stacked-PR CI admission changes; no high-confidence correctness, security, or runtime issues on changed lines. Files Reviewed (12 files)
Reviewed by grok-4.6 · Input: 106.5K · Output: 21.4K · Cached: 892.7K Review guidance: REVIEW.md from base branch |
This was referenced Aug 28, 2026
eshurakov
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No new behavior — The app keeps the same screens, controls, and available actions while this change supports older connections.
Summary
instanceSchemaadds optionalkind,startedAt, andgitBranchtoInstanceandCLIOutboundMessageSchema; older producers can omit them or the whole instance.kindacceptscliorremote;startedAtrequires a 24-character datetime with exactly three fractional-second digits.gitBranchaccepts zero to 24 characters, and invalid supplied metadata still causes heartbeat rejection.Files
services/session-ingest/src/types/user-connection-protocol.ts— Source; modified; 6 additions, 1 deletion. Retainsname,projectName, andversion. Identifies terminal and remote processes while keeping metadata optional until older producers and attachments retire.services/session-ingest/src/types/user-connection-protocol.test.ts— Test; modified; 60 additions, 0 deletions. Expands the protocol test file.ConnectedInstanceRowadoptsInstance, andgetConnectedInstancesincludes supplied details while preserving legacy rows without replacement values.handleHeartbeattries the full attachment, then retries withoutkind,startedAt, andgitBranchonly for the native 16,384-byte capacity error.The retry preserves current heartbeat data and legacy identity; unrelated errors and failed retries still propagate.
Files
services/session-ingest/src/dos/UserConnectionDO.ts— Source; modified; 34 additions, 7 deletions. Reads metadata from the latest attachment, including hibernated connections. Retains identity, closed-socket, and 30-second heartbeat filters. The single retry requires anErrornamedErrorand at least one new metadata field. It retains sessions, heartbeat time, protocol version, capabilities, authenticated identity, and legacyname,projectName, andversion. A successful retry leaves listings without the three optional fields. Successful writes retainsessions.heartbeatandheartbeat_ack. Compatibility remains until older producers and attachments retire and enriched heartbeats demonstrate native capacity safety.services/session-ingest/src/dos/UserConnectionDO.test.ts— Test; modified; 265 additions, 50 deletions. Revises the connection object test file.services/session-ingest/src/routes/api.test.ts— Test; modified; 34 additions, 0 deletions. Expands the ingest route test file.USER_CONNECTION_DOand the test-onlyv3migration makeUserConnectionDOavailable to the integration worker throughnew_sqlite_classes.The native attachment compatibility test can use the Durable Object without a production migration.
Files
services/session-ingest/wrangler.test.jsonc— Source; modified; 8 additions, 0 deletions. Adds the test binding and SQLite class registration to the authored Wrangler configuration.services/session-ingest/test/integration/user-connection-attachment.test.ts— Test; added; 181 additions, 0 deletions. Adds the native heartbeat attachment compatibility target named by continuous integration (CI).services/session-ingest/test/test-worker.ts— Test helper; modified; 2 additions, 0 deletions. Updates the worker entry point for Wrangler integration tests.pull_requestno longer restricts the base branch in the CI workflows, allowing checks for stacked pull requests.The
workspace-testsjob adds acloudflare-session-ingestintegration step for native heartbeat attachment compatibility after workspace tests.pushstill targets onlymain; existing change detection, mobile path filters, job conditions, andworkflow_callremain.Files
.github/workflows/ci.yml— Source; modified; 4 additions, 1 deletion. Removes the base filter. Runspnpm --filter cloudflare-session-ingest run test:integration test/integration/user-connection-attachment.test.tsafter workspace tests for the matching matrix entry..github/workflows/extension-ci.yml— Source; modified; 0 additions, 1 deletion. Removes the base filter while preserving extension change detection for verification, Firefox builds, and Chrome end-to-end tests..github/workflows/kilo-app-ci.yml— Source; modified; 0 additions, 1 deletion. Removes the base filter while preserving mobile and dependency path filters, reusable calls, and verification jobs.scripts/changed-dependencies.test.mjs— Test; modified; 86 additions, 0 deletions. Expands the dependency change detection test file.Tests: 6 files (1 added, 5 modified; 628 additions, 50 deletions):
changed-dependencies.test.mjs,UserConnectionDO.test.ts,api.test.ts,user-connection-protocol.test.ts,user-connection-attachment.test.ts, andtest-worker.ts.Generated: 0 files changed.
Visual Changes
Visual Changes: N/A
This pull request changes no screens. N/A means no accepted attachment report; the complete section includes visual changes.
Verification
Local end-to-end verification on an iOS simulator, 2026-09-01. Seven of nine checks passed. Two have partial coverage.
This section covers the stack's six PRs together: #5666, #5668, #5677, #5680, #5685, and #5686.
No product bug was found. No product source changed. The worktree stayed clean.
#77537band#481fd3on separate lines.Remotes and locale evidence
The installed CLI 7.5.6 reports no
kind, so every real relay lands under Terminals and the Remotes group is unreachable through it. A stand-in producer therefore attached over the real CLI WebSocket contract (/api/user/cli,instanceSchemainservices/session-ingest/src/types/user-connection-protocol.ts) and heartbeat an instance identity. Everything below the CLI process is the shipped path: the durable object,getConnectedInstances,activeSessions.listInstances, and the picker.Two
kind: 'remote'instances and onekind: 'cli'instance produced:Cloud Agent, thenREMOTESwith both remote rows, thenTERMINALSwith the terminal row.feature/remotes-verify1is 23 code points and rendered asfeature/remotes-veri…, exactly the documented 20-code-point boundary.startedAtrenderedmainalone, with no separator and no date.Started Sep 1, 2026 at 7:51 AM. German renderedGestartet 1. Sept. 2026, 07:51— day-first, German month, 24-hour clock.REMOTESbecameREMOTE-INSTANZENin German.Remotes, ci-runner-eu-west on cloud, and feature/remotes-veri… · Started Sep 1, 2026 at 7:51 AM.instance-picker-row-3c7b01,-fe6b0a, and-377bcdwere byte-identical across both locales, so the identifier does not depend on displayed facts.Run on: ci-runner-eu-west · cloud.Untested condition
The offline banner is driven only by NetInfo device connectivity.
createOfflineBannerStorecommitsonlineas soon as NetInfo reports a connection and runs its HTTP probe only to suppress a false NetInfo offline report (apps/mobile/src/lib/offline-banner-state.ts:67-88). A backend-only outage with the device still online therefore shows no banner by design. A real device-wide outage was not simulated, so that path has no runtime verdict.Setup
mobile-ux-ad6d-s6, simulator iPhone 17 Pro on iOS 26.5.xcrun simctl io <udid> screenshot./Users/igor/Projects/.scratch/local-e2e-ux/.Unrelated observation
After "Allow once" on a tool permission, repeated Back taps did not leave the chat screen; a cold restart restored navigation. Evidence:
/Users/igor/Projects/.scratch/local-e2e-ux/C-back-stuck.png. None of these six PRs touch navigation, and the symptom was not reproduced in a second round. It needs a real CLI relay executing a command to reproduce, so it is recorded here rather than diagnosed.