feat(cloud-agent-next): expose worktree ownership on getSession

[kilo-code-bot]

Summary

getSession now exposes the session's worktree ownership so clients can read it through the public API instead of querying PostgreSQL directly.

GetSessionOutput gains three optional, nullable fields:

Field	Data source
worktreeId	Session Durable Object metadata: metadata.workspace.worktreeId (MetadataWorkspaceSchema)
parentSessionId	PostgreSQL cli_sessions_v2.parent_session_id
cloudAgentSessionScopeId	PostgreSQL cli_sessions_v2.cloud_agent_session_scope_id

The PostgreSQL row is read with the same columns and query shape as findOwnershipRow in session-worktree.ts, via getPgDb(ctx.env), keyed by kilo_user_id, session_id, and cloud_agent_session_id.

Why PostgreSQL is only read for worktree sessions

parentSessionId and cloudAgentSessionScopeId are not stored in the session Durable Object metadata — they only exist on the cli_sessions_v2 ownership row. Ordinary sessions have no worktree and therefore no grouped ownership to return, so the handler gates the ownership read on metadata.workspace.worktreeId. This keeps getSession for ordinary sessions free of this additional database round-trip. When a worktree session has no ownership row, parentSessionId and cloudAgentSessionScopeId are returned as null; for non-worktree sessions the three fields are omitted.

No tokens, callback targets, or callback headers are exposed.

Changes

• services/cloud-agent-next/src/router/schemas.ts — extend GetSessionOutput with worktreeId, parentSessionId, cloudAgentSessionScopeId
• services/cloud-agent-next/src/router/handlers/session-management.ts — read worktree ownership for worktree sessions
• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts — mirror the output type
• services/cloud-agent-next/src/router.test.ts — focused coverage for present, no-row, and non-worktree cases

Verification

• ./node_modules/.bin/vitest run src/router.test.ts → 150 passed
• ./node_modules/.bin/vitest run src/router.test.ts -t "worktree ownership" → 3 passed
• ./node_modules/.bin/tsgo --noEmit (services/cloud-agent-next) → passed
• ./node_modules/.bin/oxlint --config .oxlintrc.json <changed files> → 0 warnings, 0 errors
• Focused tsgo on apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts → passed

Not completed: the full apps/web jest/typecheck. The web jest global setup requires a reachable shared PostgreSQL (pnpm test:db) and Docker is unavailable in this environment, and the full apps/web tsgo run exceeded the 2-minute command budget.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The prior baseGetSessionNextOutputSchema finding is resolved: commit a04fb3e9e mirrors worktreeId, parentSessionId, and cloudAgentSessionScopeId into the web tRPC output schema (matching services/cloud-agent-next/src/router/schemas.ts) with focused coverage, and the incremental diff introduces no new issues.

Files Reviewed (2 files)

• apps/web/src/routers/cloud-agent-next-schemas.ts - 0 issues
• apps/web/src/routers/cloud-agent-next-schemas.test.ts - 0 issues

Resolved in a04fb3e

• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts:352 - the new ownership fields are no longer stripped by .output() parsing for cloudAgentNext.getSession, organizationCloudAgentNext.getSession, and cliSessionsV2.getWithRuntimeState(...).runtimeState.

Previous Review Summary (commit 942ecdd)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 942ecdd)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts	352	Web tRPC output schemas (baseGetSessionNextOutputSchema) omit the new worktreeId / parentSessionId / cloudAgentSessionScopeId fields, so zod strips them for consumers reaching the worker via those procedures

Files Reviewed (4 files)

• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts - 1 issue
• services/cloud-agent-next/src/router.test.ts - 0 issues
• services/cloud-agent-next/src/router/handlers/session-management.ts - 0 issues
• services/cloud-agent-next/src/router/schemas.ts - 0 issues

Fix these issues in Kilo Cloud

No memory-leak or security exposure found: the added read is a single PK-indexed lookup gated to worktree sessions, the pool is per-request as elsewhere in the handler, and only non-secret identifiers are returned.

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}