fix(cli): repair cloud session imports

[eshurakov]

Summary

• Move Cloud Agent session imports fully onto the core EventV2 database transaction, with the session, transcript, and creation event committed atomically.
• Strictly validate and remap session, message, part, nested attachment, parent, and compaction references into the target project/workspace without mutating the cloud export.
• Restore workspace diffs only after persistence, expose a bounded typed 500 response for internal failures, and keep malformed exports as 400 responses.

Why

The Effect handler crossed into the legacy database client. Native binaries then attempted to read migrations from /$bunfs/migration, while source runs could insert the session twice through the legacy transaction and EventV2 projector. Keeping one persistence owner removes both failure modes and prevents partially imported transcripts or filesystem changes.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilocode/server/httpapi/handlers/kilo-gateway.ts	540	Message/part inserts still lack onConflictDoNothing(), so a genuine ID collision surfaces as a 500 instead of no-op. Author confirmed (in thread) this is intentional: prepareSessionImport mints fresh IDs per request, this endpoint never provided idempotent retries, and a collision should abort/roll back the EventV2 transaction rather than silently commit an incomplete transcript. Left open for final sign-off, not blocking.

New in this update (commit `5255b4446d`)

packages/kilo-gateway/src/cloud-sessions.ts was refactored to validate cloud session exports with a Zod schema (exportSchema/superRefine) instead of ~18 manual throw statements, per human reviewer feedback. Reviewed the new schema and remapping logic for parity with the previous hand-rolled validation (duplicate/dangling/circular parent and part-ID checks, tool-attachment shape, compaction tail resolution) — behavior is preserved and the change is confined to the Kilo-owned kilo-gateway package. No new issues found.

Files Reviewed (13 files)

• .changeset/cloud-session-import.md
• packages/kilo-gateway/src/cloud-sessions.ts
• packages/kilo-gateway/src/index.ts
• packages/kilo-gateway/src/server/routes.ts
• packages/kilo-gateway/test/cloud-sessions.test.ts
• packages/opencode/src/kilocode/server/httpapi/groups/kilo-gateway.ts
• packages/opencode/src/kilocode/server/httpapi/handlers/kilo-gateway.ts
• packages/opencode/test/kilocode/server/cloud-session-import.test.ts
• packages/opencode/test/kilocode/server/kilo-gateway-statuses.test.ts
• packages/sdk/js/src/v2/gen/types.gen.ts
• packages/sdk/openapi.json
• script/check-opencode-promise-facades.ts

Fix these issues in Kilo Cloud

Previous Review Summaries (2 snapshots, latest commit 11b673e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 11b673e)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilocode/server/httpapi/handlers/kilo-gateway.ts	540	Message/part inserts dropped onConflictDoNothing(), so a genuine ID collision now surfaces as a 500 instead of no-op. Author noted prepareSessionImport mints fresh IDs per request so this shouldn't occur in practice; still worth confirming there's no legitimate retry path.

Resolved since last review

• packages/kilo-gateway/test/cloud-sessions.test.ts — time.updated assertion now bounds the result between timestamps captured immediately before/after prepareSessionImport, closing the tautological-assertion gap.
• .changeset/cloud-session-import.md — Description rewritten to describe this as a repair/hardening of existing Cloud Agent session imports rather than a new capability.

Files Reviewed (2 files changed since last review)

• .changeset/cloud-session-import.md
• packages/kilo-gateway/test/cloud-sessions.test.ts

Fix these issues in Kilo Cloud

Previous review (commit 7c35a20)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilocode/server/httpapi/handlers/kilo-gateway.ts	540	Message/part inserts dropped onConflictDoNothing(), so duplicate-ID retries now surface as a 500 instead of no-op

SUGGESTION

File	Line	Issue
packages/kilo-gateway/test/cloud-sessions.test.ts	178	time.updated assertion is nearly tautological and wouldn't catch a no-op regression
.changeset/cloud-session-import.md	6	Changeset wording overstates this as a new capability rather than a fix/hardening of existing import behavior

Files Reviewed (12 files)

• .changeset/cloud-session-import.md
• packages/kilo-gateway/src/cloud-sessions.ts
• packages/kilo-gateway/src/index.ts
• packages/kilo-gateway/src/server/routes.ts
• packages/kilo-gateway/test/cloud-sessions.test.ts
• packages/opencode/src/kilocode/server/httpapi/groups/kilo-gateway.ts
• packages/opencode/src/kilocode/server/httpapi/handlers/kilo-gateway.ts
• packages/opencode/test/kilocode/server/cloud-session-import.test.ts
• packages/opencode/test/kilocode/server/kilo-gateway-statuses.test.ts
• packages/sdk/js/src/v2/gen/types.gen.ts
• packages/sdk/openapi.json
• script/check-opencode-promise-facades.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5 · Input: 42 · Output: 14.5K · Cached: 1.2M}

_{Review guidance: REVIEW.md from base branch main}

[marius-kilocode]

@eshurakov kilo-gateway already depends on Zod and uses safeParse() elsewhere. Would it not make sense to use that instead of adding 18 throws?

[eshurakov]

@marius-kilocode I've fixed it