feat(cli): log remote session start and end

[iscekic]

Changelog for users

• kilo remote now records every session it hosts in two log lines: one when the session starts and one when it ends.
• The start line carries the session id, the start date, the model and the working directory.
• The end line carries the session id, the same start date, the duration and the exit reason (detached, shutdown or deleted).
• A session the relay refuses is rolled back and gets no start line.
• Neither line contains a credential, a token or the prompt text.

Changelog for maintainers

• A new RemoteSessionLog module under kilo-sessions/ keeps each session's start date in memory and writes both lines through the CLI's existing logger; it adds no file, dependency or telemetry.
• create_session now waits for the relay to accept the session's ingest bootstrap before the CLI hosts it; attachSession takes requireShare and fails the command when the relay refuses.
• BootstrapOutcome gains a skipped flag, so a bootstrap that never reached the relay (no credentials, ingest disabled) still allows hosting.
• End lines are emitted on exit_cli detach, on session deletion, and process-wide from KiloShutdown, so Ctrl-C still closes the sessions a run started.
• cli/cmd/remote.ts captures the instance context before the signal handlers and runs teardown inside context.provide, removing the Ctrl-C unhandled-rejection trace; a failed teardown logs remote shutdown failed.
• RemoteSessionLog.end is a no-op for a session this run did not start, so an adopted session produces no half line.
• Review first the requireShare gate (create_session attach in remote-sender.ts and ensureSharedSession in kilo-sessions.ts) and the shutdown path in cli/cmd/remote.ts.
• No test-only runtime flag, committed fixture or harness was added; .changeset/remote-session-log.md covers the user-facing change.

E2E proof

INFO  2026-09-16T13:56:37 +46ms service=kilo-sessions sessionID=ses_f557eaee8ffe4XX3ntf7Yzf0gf startedAt=2026-09-16T13:56:37.994Z directory=/home/igor_kilocode_ai/.local/share/kwf/wt/kilo-remote-session-logging-aca9/packages/opencode remote session started
INFO  2026-09-16T13:56:40 +105ms service=kilo-sessions sessionID=ses_f557eaee8ffe4XX3ntf7Yzf0gf startedAt=2026-09-16T13:56:37.994Z durationMs=2906 reason=detached remote session ended

INFO  2026-09-16T13:47:32 +174ms service=kilo-sessions sessionID=ses_f5586fd96ffezJQyBE9hMF1llt startedAt=2026-09-16T13:47:32.540Z directory=/home/igor_kilocode_ai/.local/share/kwf/wt/kilo-remote-session-logging-aca9/packages/opencode remote session started
INFO  2026-09-16T13:48:05 +163ms service=kilo-sessions sessionID=ses_f5586fd96ffezJQyBE9hMF1llt startedAt=2026-09-16T13:47:32.540Z durationMs=33112 reason=shutdown remote session ended

occurrences of 'token': 0
occurrences of 'MARKER7f3a' (the prompt text used in this run): 0
occurrences of Authorization/Bearer/sk-/KILO_API_KEY: 0

WARN  2026-09-16T13:45:15 +0ms service=kilo-sessions id=v8cs sessionID=ses_f558915a5ffey4oHOKS9lWPP4l create session rolled back

Owner request

Surface: the Kilo Code CLI.

kilo remote logs nothing about the sessions it runs, so a finished run leaves
no trace of what ran.

Log basic session information on start and on end: the session id, the start
date, and whatever else is already at hand and worth knowing -- the model, the
working directory, the exit reason, the duration. Keep it simple: two log
lines, at the CLI's existing log level and through its existing logger. No new
file, no new dependency, no telemetry.

Never log a credential, a token or the prompt text.

Verify: run kilo remote, end the session, and show both log lines with the
id, the start date and the duration. Paste the two lines.

Follow-ups (not changed here)

Open findings (not fixed here)

• [e2] create_session with a rejected relay heartbeat is rolled back and writes no start line: Fresh run (stub ingest relay answers POST /api/session with 409 Conflict): the host did NOT roll the session back and DID write the start line — the relay rejection is observed as "WARN 2026-09-16T13:29:37
• [e2] start a session, then Ctrl-C the host: shutdown end line before the process exits
• [e2] start a session, then Ctrl-C the host: shutdown end line before the process exits: The shutdown line itself is correct: 'startedAt=2026-09-16T11:05:44.568Z durationMs=11537 reason=shutdown remote session ended' pairs the start line at 11:05:44.568Z, but Ctrl-C on the normal exit path also print

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Incremental review since 1f1acf4a38: the only new change is the timeout headroom added to the root-permission-rejection tests (pollWithTimeout/awaitWithTimeout now use "15 seconds"), which matches the helper signatures in test/lib/effect.ts and the sibling tests in the file. No new defects found.

Files Reviewed (2 files)

• packages/opencode/test/kilocode/session-prompt-permission-refresh.test.ts - no issues
• packages/opencode/src/snapshot/index.ts - no issues (no longer part of this PR's diff against base)

Previous Review Summaries (3 snapshots, latest commit 1f1acf4)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 1f1acf4)

Status: 1 Issue Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/opencode/src/snapshot/index.ts	923	Unrelated snapshot-materialization behavior change bundled in: init resume now waits KiloSnapshotMaterialize.idle() and is skipped when the snapshot repo does not exist. Not mentioned in the PR body and not covered by the changeset.

Files Reviewed (10 files)

• .changeset/remote-session-log.md - no issues
• packages/opencode/src/cli/cmd/remote.ts - no issues
• packages/opencode/src/kilo-sessions/kilo-sessions.ts - no issues
• packages/opencode/src/kilo-sessions/remote-sender.ts - no issues
• packages/opencode/src/kilo-sessions/remote-session-log.ts - no issues
• packages/opencode/src/snapshot/index.ts - 1 suggestion
• packages/opencode/test/kilocode/kilo-sessions.test.ts - no issues
• packages/opencode/test/kilocode/sessions/remote-session-log.test.ts - no issues
• packages/opencode/test/kilocode/snapshot-prepare.test.ts - no issues
• script/check-opencode-promise-facades.ts - no issues

The previously reported issues are no longer present at 1f1acf4a38: the requireShare gate now only fails hosting on a RelayRefusal (permanent 4xx) so transient 5xx/408/429/network failures stay hosted, disableRemote(reason) drains the session log before clearing attached state and defaults to "disabled" for the user-initiated path, the share-gate test installs its fetch stub through spyOn, and the session-log suite drains in beforeEach.

Fix these issues in Kilo Cloud

Previous review (commit 9b7055d)

Status: 1 Issue Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/opencode/src/kilo-sessions/kilo-sessions.ts	1036	disableRemote(reason = "shutdown") defaults user-initiated disable (HTTP remote/disable and the per-directory instance finalizer) to reason=shutdown in the new end line

Files Reviewed (8 files)

• .changeset/remote-session-log.md - no issues
• packages/opencode/src/cli/cmd/remote.ts - no issues
• packages/opencode/src/kilo-sessions/kilo-sessions.ts - 1 suggestion
• packages/opencode/src/kilo-sessions/remote-sender.ts - no issues
• packages/opencode/src/kilo-sessions/remote-session-log.ts - no issues
• packages/opencode/test/kilocode/kilo-sessions.test.ts - no issues
• packages/opencode/test/kilocode/sessions/remote-session-log.test.ts - no issues
• script/check-opencode-promise-facades.ts - no issues

The four findings from the previous review are fixed at 9b7055d3a7: transient bootstrap failures (503/429/network) no longer roll the session back, disableRemote(reason) drains the session log before clearing attached state, the share-gate test no longer leaks a raw globalThis.fetch stub, and the session-log suite drains in beforeEach.

Fix these issues in Kilo Cloud

Previous review (commit b7924c8)

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilo-sessions/kilo-sessions.ts	1085	ensureSharedSession throws for transient bootstrap failures (5xx/408/429/network), so create_session rolls back a valid session instead of only on an explicit relay refusal
packages/opencode/src/kilo-sessions/remote-session-log.ts	28	open is never drained when hosting ends outside exit_cli/deletion (disableRemote resets attached state on WS close), so entries accumulate across reconnects and endAll emits stale end lines with inflated durations
packages/opencode/test/kilocode/kilo-sessions.test.ts	1680	globalThis.fetch is reassigned directly and mock.restore() cannot revert a raw assignment, leaking the stub past this describe block

SUGGESTION

File	Line	Issue
packages/opencode/test/kilocode/sessions/remote-session-log.test.ts	283	Process-global RemoteSessionLog.open is never reset between cases, making the suite order-dependent

Files Reviewed (7 files)

• .changeset/remote-session-log.md - no issues
• packages/opencode/src/cli/cmd/remote.ts - no issues
• packages/opencode/src/kilo-sessions/kilo-sessions.ts - 1 warning
• packages/opencode/src/kilo-sessions/remote-sender.ts - no issues
• packages/opencode/src/kilo-sessions/remote-session-log.ts - 1 warning
• packages/opencode/test/kilocode/kilo-sessions.test.ts - 1 warning
• packages/opencode/test/kilocode/sessions/remote-session-log.test.ts - 1 suggestion

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

This description names a scenario the proof did not capture:

• not proved live: - [e2] create_session whose relay heartbeat is rejected is rolled back with no start line: reported not_applicable, so nothing proves it (The product has no such branch: Inbound is only subscribe|unsubscribe|command|system|heartbeat_ack (remote-protocol.ts:128), and three live relay-failure attemp) — reported not_applicable: the plan names a branch the product does not contain

A repeated proof run rebuilds the same evidence, so no proof run is dispatched for a named gap. Merging with this gap open is your decision.