fix(code-reviews): restore live review transcripts

[eshurakov]

Summary

• Restore live Code Reviewer progress for organization members by polling the existing review-authorized transcript endpoint instead of requesting creator-only access to bot-owned sessions. Personal reviews retain WebSockets and now render canonical text parts without requiring tool-state metadata.
• Keep review status fresh, reconcile persisted transcripts briefly after completion, and isolate state and late callbacks when switching attempts. Recoverable errors stay inside the log area so attempt selection remains available; authorization failures hide cached transcript data and runtime IDs.
• Scope transcript lookup to the review's owner/organization and selected attempt, including runtime-only continuations, without broadening generic Cloud Agent session access.

Verification

Browser and API verification against the local development stack on August 29:

• Ran a local read-only organization review with kilo-auto/efficient, viewed by an ordinary member rather than the bot/session creator. Observed 16 changing log snapshots while running; the final transcript contained 11 persisted messages. Final text remained visible and transcript polling stopped after the terminal reconciliation window.
• Ran a personal review through the real Worker, Durable Object, sandbox, wrapper, and browser WebSocket, with deterministic inference only. Canonical text rendered before completion and the final two-message transcript persisted.
• Switched attempts and deep links. Temporarily stopped local session-ingest: the error remained visible, attempt selection stayed usable, and selecting the completed attempt recovered its transcript after the service restarted.
• Confirmed generic bot-session stream tickets still return 403, personal non-owner transcript reads return 403, and cross-review attempt lookups return 404. Revoking organization membership denied both transcript and stream-info reads; refresh hid cached content and runtime identity. Membership was restored. This revocation check occurred after completion, not during an active model run.

Visual Changes

The existing layout is retained; live log content and recoverable error behavior change.

Before	After
Screenshot not captured.	Screenshot unavailable: browser screenshot capture timed out. Live updates and error/attempt navigation were verified through DOM and network observations.

Reviewer Notes

• Generic Cloud Agent session authorization remains creator-only. Organization transcripts recheck review membership on every read, and session lookup fails closed for mismatched or ambiguous mappings.
• Successful local runs used Cloud Agent Next's V2 legacy execution plane. The worktree's enabled control-plane path failed before execution with Prepared admission is legacy-only; a temporary Worker CLI override disabled control-plane enrollment for verification and was removed afterward. This existing execution-path incompatibility is outside this web fix.
• All review jobs used local read-only output mode: no GitHub comments, statuses, or reactions were published. No Worker changes, migrations, production dependencies, or deployments are included.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental changes keep nonempty live and polled logs across empty transcript snapshots and scope retained events to the current review/attempt, with no new high-confidence issues.

Files Reviewed (3 files)

• apps/web/src/components/code-reviews/CodeReviewStreamView.test.ts
• apps/web/src/components/code-reviews/CodeReviewStreamView.tsx
• apps/web/src/routers/organizations/organization-modes-router.test.ts

Previous Review Summary (commit 1099e06)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 1099e06)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Empty successful getSessionMessages payloads can wipe live WebSocket events and previously polled org transcripts during ingest lag.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/components/code-reviews/CodeReviewStreamView.tsx	347	Empty successful transcripts replace live events

Files Reviewed (9 files)

• apps/web/src/app/(app)/code-reviews/[reviewId]/CodeReviewDetailClient.tsx
• apps/web/src/components/code-reviews/CodeReviewStreamView.test.ts
• apps/web/src/components/code-reviews/CodeReviewStreamView.tsx - 1 issue
• apps/web/src/components/code-reviews/code-review-stream-behavior.test.ts
• apps/web/src/components/code-reviews/code-review-stream-behavior.ts
• apps/web/src/components/code-reviews/code-review-stream-events.test.ts
• apps/web/src/components/code-reviews/code-review-stream-events.ts
• apps/web/src/routers/code-reviews-router.test.ts
• apps/web/src/routers/code-reviews/code-reviews-router.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by grok-4.6 · Input: 74.8K · Output: 10.5K · Cached: 230.7K}

_{Review guidance: REVIEW.md from base branch main}