fix(cloud-agent): improve failure reporting and log retention

[eshurakov]

Summary

• Preserve distinct wrapper-attempt log archives and complete bounded final uploads before bootstrap failure cleanup.
• Keep precise, safe failure causes across Worker state, queue reports and admin health. Correct watchdog, payment/cancellation and GitHub credential-error handling without changing retry budgets or weakening credential containment.
• Create reporting anchors for newly allocated legacy clone sessions, retry missing-parent reports, and prevent replay from restoring expired diagnostic text.
• Show affected sessions, known sandboxes, top-error coverage and coherent latest-matching-run diagnostics in the health drilldown. Use normalized reasons and redacted messages instead of an extra SDK-facts payload.
• Include one generated expiry-only migration; no additional diagnostic DB column.

Verification

• Inspected the isolated local PostgreSQL schema after cleanup: the unused facts column is absent, the expiry constraint is correct, and existing data and migration history were preserved.
• Earlier local browser QA exercised health counts/filtering, latest matching run/setup details, expired-text masking, responsive layouts and Escape/Close focus restoration; no transcript requests were observed.
• The final facts-free UI pass was not browser-retested. No real-model/container smoke or production deployment was performed.

Visual Changes

Before	After
Not captured	Not captured

The existing health table gains impact counts and expanded redacted diagnostic details. Screenshot capture failed during local QA; no before/after image evidence is claimed.

Reviewer Notes

• Apply 0234_cloud_agent_error_expiry.sql before deploying cleanup code that retains expiry markers. The large generated snapshot differs from the preceding snapshot only in IDs and this constraint.
• Roll out git-token-service before cloud-agent-next and keep report producers/consumers aligned. Reporting remains best-effort; no historical backfill, outbox, or retry/concurrency policy change is included.
• Automated DB/web, migration, shared-contract and Workers integration checks passed, as did scoped lint/typechecks and wrapper bundles. Git-token-service: 580 tests passed. Cloud Agent Node: 3,636 passed and 3 skipped with a 15-second test timeout; the default run hit a baseline Git-process timing limit.
• The full Bun wrapper run had 429 passes and two timing-sensitive failures in unchanged lifecycle/restore tests; baseline-only diagnostics reproduced their timing assumptions. Known non-fatal Workers teardown warnings remain. Targeted DB consistency/expiry checks passed; the broader DB suite has a pre-existing missing historical migration fixture.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of bootstrap-diagnostic archive ordering at HEAD 6ea5d13d: sanitized setup-failure details are now logged before workspace cleanup finalizes the archive. No high-confidence issues on changed lines.

Files Reviewed (2 files)

• services/cloud-agent-next/wrapper/src/session-bootstrap.ts
• services/cloud-agent-next/wrapper/src/session-bootstrap.test.ts

Previous Review Summaries (2 snapshots, latest commit 4f13bc6)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 4f13bc6)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of diagnostic-expiry pairing at HEAD 4f13bc6a: constraint restored to match main, unshipped 0234 dropped, and expired run diagnostics now clear text and expiry together. No high-confidence issues on changed lines.

Files Reviewed (8 files)

• apps/web/src/routers/admin-cloud-agent-next-router.test.ts
• packages/db/src/migrations/0234_cloud_agent_error_expiry.sql
• packages/db/src/migrations/meta/0234_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.test.ts
• packages/db/src/schema.ts
• services/cloud-agent-next/src/telemetry/report-store.test.ts
• services/cloud-agent-next/src/telemetry/report-store.ts

Previous review (commit 2fb12c2)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed failure reporting, log-archive retention, GitHub credential classification, diagnostic expiry, and admin health drilldown at HEAD 2fb12c21; no high-confidence security, runtime, or logic issues on changed lines.

Files Reviewed (64 files)

• apps/web/src/app/admin/components/CloudAgentNextTelemetry/CloudAgentNextOutcomesPage.tsx
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-summary.test.ts
• apps/web/src/app/admin/components/CloudAgentNextTelemetry/health-summary.ts
• apps/web/src/lib/code-reviews/terminal-reason-from-failure.test.ts
• apps/web/src/lib/code-reviews/terminal-reason-from-failure.ts
• apps/web/src/routers/admin-cloud-agent-next-router.test.ts
• apps/web/src/routers/admin-cloud-agent-next-router.ts
• packages/db/src/migrations/0234_cloud_agent_error_expiry.sql
• packages/db/src/migrations/meta/0234_snapshot.json
• packages/db/src/migrations/meta/_journal.json
• packages/db/src/schema.test.ts
• packages/db/src/schema.ts
• packages/worker-utils/src/cloud-agent-failure.test.ts
• packages/worker-utils/src/cloud-agent-failure.ts
• packages/worker-utils/src/cloud-agent-queue-report.test.ts
• packages/worker-utils/src/cloud-agent-queue-report.ts
• services/cloud-agent-next/src/persistence/CloudAgentSession.ts
• services/cloud-agent-next/src/persistence/session-metadata.test.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/services/git-token-service-client.test.ts
• services/cloud-agent-next/src/services/git-token-service-client.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session/safe-failure-projection.test.ts
• services/cloud-agent-next/src/session/safe-failure-projection.ts
• services/cloud-agent-next/src/session/session-message-queue.test.ts
• services/cloud-agent-next/src/session/session-message-queue.ts
• services/cloud-agent-next/src/session/session-message-state.test.ts
• services/cloud-agent-next/src/session/session-message-state.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/session/wrapper-supervisor.test.ts
• services/cloud-agent-next/src/session/wrapper-supervisor.ts
• services/cloud-agent-next/src/shared/assistant-failure.ts
• services/cloud-agent-next/src/shared/ingest-frame.test.ts
• services/cloud-agent-next/src/shared/ingest-frame.ts
• services/cloud-agent-next/src/telemetry/queue-reports.test.ts
• services/cloud-agent-next/src/telemetry/queue-reports.ts
• services/cloud-agent-next/src/telemetry/report-consumer.test.ts
• services/cloud-agent-next/src/telemetry/report-consumer.ts
• services/cloud-agent-next/src/telemetry/report-store.test.ts
• services/cloud-agent-next/src/telemetry/report-store.ts
• services/cloud-agent-next/src/telemetry/session-reports.test.ts
• services/cloud-agent-next/src/telemetry/session-reports.ts
• services/cloud-agent-next/src/websocket/ingest.test.ts
• services/cloud-agent-next/src/websocket/ingest.ts
• services/cloud-agent-next/test/integration/session/admission-recovery.test.ts
• services/cloud-agent-next/test/integration/session/execute-directly-failure.test.ts
• services/cloud-agent-next/test/integration/session/message-terminalization.test.ts
• services/cloud-agent-next/test/unit/wrapper/batch-admission.test.ts
• services/cloud-agent-next/vitest.workers.config.ts
• services/cloud-agent-next/wrapper/src/log-uploader.test.ts
• services/cloud-agent-next/wrapper/src/log-uploader.ts
• services/cloud-agent-next/wrapper/src/main.ts
• services/cloud-agent-next/wrapper/src/server.test.ts
• services/cloud-agent-next/wrapper/src/server.ts
• services/cloud-agent-next/wrapper/src/session-bootstrap.test.ts
• services/cloud-agent-next/wrapper/src/session-bootstrap.ts
• services/cloud-agent-next/wrapper/src/shutdown.test.ts
• services/cloud-agent-next/wrapper/src/state.ts
• services/git-token-service/src/github-token-service.test.ts
• services/git-token-service/src/github-token-service.ts
• services/git-token-service/src/index.test.ts
• services/git-token-service/src/index.ts

---

_{Reviewed by grok-4.6 · Input: 58.6K · Output: 9.2K · Cached: 470.7K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

lgtm, bot feedback below

[pandemicsyn]

bot: The bootstrap-failure archive is finalized before readySession records its terminal failure diagnostic.

Suggested fix: Record the sanitized bootstrap failure before this finalization callback runs (for example, have the bootstrap failure path write/return the safe failure record before cleanupWorkspace invokes beforeFailureCleanup), then finalize and upload before deleting the workspace. Add an integration test that exercises the production readySession catch path and asserts the finalized archive contains the terminal safe error.