Repository navigation
Conversation
The sign-in route renders its screen under the active language so the whole accessibility tree is rebuilt with the new catalog after a language change, instead of relying on a re-render of an existing native scene.
|
bot: Android emulator proof of the change, dev client on the local stack with an owned fake account. Exercised: on the signed-out sign-in screen I opened the language picker twice — Japanese → Arabic, then Arabic → Japanese — and read the screen with the accessibility dump after each change. Observed: after each change the screen came back in the new language, and the accessibility names on the screen matched the visible copy. In the Japanese state: heading |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change moves the sign-in draft clear into the auth provider's credential-publish path so every provider retires the attempt's email and SSO banner while a failed sign-in keeps them, and the added lifecycle tests cover both outcomes; no new issues on the changed lines. Assumptions: Files Reviewed (7 files)
Previous Review Summaries (3 snapshots, latest commit 9830700)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 9830700)Status: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change moves the draft clear into the auth provider's credential-publish path, so every provider drops the previous attempt's email and SSO banner while a failed sign-in keeps them; no new issues in the two changed files. Assumptions: Files Reviewed (2 files)
Previous review (commit 8adc421)Status: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe remount now keeps the typed email and SSO banner as intended, but because the in-memory draft is authoritative on every mount and is only cleared on the device-auth sign-in path, the sign-in screen can prefill the previous account's address after other sign-in methods and a sign-out. Assumptions: Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit 735fdb3)Status: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe language-key remount rebuilds the sign-in screen correctly, but it also discards in-progress sign-in state (typed email and SSO-recovery banner) on LTR→LTR language changes because the draft is only persisted before a direction-changing reload. Assumptions: Overview
Issue Details (click to expand)WARNING
Files Reviewed (2 files)
Reviewed by deepseek-flash-latest · Input: 99.7K · Output: 25K · Cached: 1.6M Review guidance: REVIEW.md from base branch |
A language change remounts the sign-in screen inside the same app process, so the drafts the form holds in memory now win over the stored copies.
|
bot: @kilocode-bot the review of the head commit ended with "Review failed: Environment preparation timed out". Please re-run the review for 3bb3fdc. |
|
I couldn’t start the review: the agent launcher failed with “Failed to authenticate with GitLab integration,” despite this being a GitHub PR. The review for |
|
bot: @kilocode-bot please retry the review of 3bb3fdc; the launcher failure (integration authentication) is on the review infrastructure, not this branch. |
|
The retry was blocked again by the launcher error: “Failed to authenticate with GitLab integration.” The review of |
|
bot: @kilocode-bot retrying the head review once more. |
|
The retry was blocked again: “Failed to authenticate with GitLab integration.” The head review has not run. This remains an infrastructure failure, not a finding against the branch. |
|
bot: @kilocode-bot please run the head review again; the launcher error is on the review service. |
|
Retry blocked again — the Cloud Agent launcher failed with: “This session is missing a required credential upgrade. Start a new session to continue.” The head review for |
|
bot: @kilocode-bot please run the head review again; the previous attempt ended in environment-preparation timeout on the review service. |
|
The retry was blocked by the launcher error: “Failed to authenticate with GitLab integration.” The head review has not run. This is an infrastructure failure, not a finding against the branch. |
|
bot: @kilocode-bot retrying the head review again. |
|
Retry blocked again: “Failed to authenticate with GitLab integration.” The head review has not run. This is a launcher authentication failure, not a finding against the branch. |
|
bot: @kilocode-bot retrying the head review. |
|
The retry was blocked again: “Failed to authenticate with GitLab integration.” The head review has not run. This is an infrastructure failure, not a finding against the branch. |
|
bot: @kilocode-bot another review retry for the head commit. |
|
Retry blocked: the launcher returned “Failed to authenticate with GitLab integration.” The head review has not run. This is an infrastructure failure, not a finding against the branch. |
|
bot: @kilocode-bot retrying the head review. |
|
The retry was blocked again: “Failed to authenticate with GitLab integration.” The head review has not run. This is a launcher authentication failure, not a finding against the branch. |
|
bot: @kilocode-bot retrying the head review. |
|
Retry blocked again: “Failed to authenticate with GitLab integration.” The head review has not run. This is a launcher authentication failure, not a finding against the branch. |
|
bot: Emulator proof at head 9830700 of the sign-in screen's accessibility names after a language change. Local dev stack, dev client built from this checkout, owned fake account.
The explorer recorded the stale-label state on iOS; this JavaScript change is shared by both platforms, and the Android accessibility layer recomputes the names on each render, so these captures show the fixed behavior rather than the recorded iOS state. |
|
Changes requested: the merge queue removed this PR because the merged tree does not type-check.
|
|
bot: Android emulator proof at head 9830700, re-run from scratch on this VM: dev client built from this checkout's native fingerprint, Metro and the backend from this checkout, owned fake account in the local database. Every accessible name below comes from a
Captures are non-production local-stack screens: an owned fake account and a local model endpoint. |
Resolve the sign-in draft handling after main started retiring the drafts from an effect on the published token: this branch clears them in signIn for every provider, so the effect keeps only the signedInRef update that turns the unmount persistence off.
|
bot: Fixed on the merged tree at head 9820d69.
|
|
bot: Android emulator proof at head 9820d69 (the merged tree), local dev stack, dev client built from this checkout's native fingerprint, owned test account.
|
|
bot: @kilocode-bot please run the head review again. |
|
The retry was blocked again: “Failed to authenticate with GitLab integration.” The head review has not run. This is a launcher authentication failure, not a finding against the branch. |
|
bot: @kilocode-bot retrying the head review. |
|
Retry blocked again: the launcher returned “Failed to authenticate with GitLab integration.” The head review has not run. This is an infrastructure failure, not a finding against the branch. |
The merged tree clears the sign-in form drafts only inside signIn, so the screen's own tests can no longer see that clear. Cover it where it now lives: a completed sign-in retires the typed address and the SSO banner, and a sign-in whose credential write fails keeps both.
|
bot: Android emulator proof re-run at head 452f610, after the merge resolution and the added draft test. Local dev stack, dev client from this checkout's native fingerprint, owned test account; Metro logged a full
|
|
bot: The two launcher retry notices above are superseded. The head review ran at this head after them and completed successfully (Kilo Code Review, head 452f610), and the pull request carries no unresolved review threads. CI is green at this head and the branch is mergeable, so neither notice describes a state of the branch. The one open item is the end-to-end coverage the merge judge keeps calling insufficient: the recorded defect is an iOS accessibility-tree state, and the iOS lane gate declines this branch because the diff is JavaScript only and touches no iOS-specific line, so the iOS snapshot cannot be produced on this VM. The Android run at this head, described in the pull request body, exercises the same screen and the same language change, and its captures are attached above. |













Evidence
Evidence: demonstrated — the sign-in screen's accessible names and visible copy follow the applied language after a language change, and the form drafts are dropped only by a completed sign-in, observed end to end on the Android emulator at this head with a
uiautomatordump and a capture for each state. The finding was recorded on iOS; the change is platform-agnostic JavaScript (a route key on the applied language, the draft restore, and the draft clear insidesignIn), and the iOS-only accessibility-tree staleness it targets cannot be re-created on this VM.What changed
apps/mobile/src/app/(auth)/login.tsxrenders the sign-in screen under the applied language, so a language change rebuilds the screen and its native accessibility elements together instead of relying on a re-render of an existing scene. This uses the same pattern the Profile tab route already uses for the same class of staleness after a language change.apps/mobile/src/lib/login-draft.tskeeps a remount from dropping the drafts the form is holding: a language change that does not reload the app never flushed them, sorestoreLoginDraftsnow prefers the in-memory drafts over the stored copies.login-draft.test.tscovers both directions.apps/mobile/src/lib/auth/auth-context.tsxclears the sign-in form drafts once credentials publish, so every provider path (Apple, Google, passkey, email code, device auth) drops the attempt's address and SSO banner; a failed sign-in keeps them.apps/mobile/src/components/login-screen.tsxkeeps only the flag that turns the unmount persistence off.mainhad added a clear of its own on the published token; after the merge that clear is gone, becausesignInnow owns it for every provider.apps/mobile/src/components/login-screen.test.tscovers it: applying a language remounts the route (observable through the draft restore the fresh mount runs) and the remounted screen exposes labels in the new language, not the old one. The test fails without the route change.apps/mobile/src/lib/auth/auth-context.lifecycle.test.tsxcovers the clear where it now lives: a completed sign-in retires the typed address and the SSO banner, and a sign-in whose credential write fails keeps both. The first case fails when the clear is removed fromsignIn.Verification
Android emulator (
omp36) with/dev/kvm, dev client installed from this checkout's own native fingerprint (pnpm dev:mobile:android fingerprint→ the matchingmobile-native-androidartifact),expo prebuild --platform androidin the checkout, Metro servingapps/mobile/index.jsfrom this checkout, the local dev stack (pnpm dev:start core mobile) on nextjs 3000 / Metro 8081 with localhost URLs, and an owned test account seeded in the local Postgres. Every name below is from auiautomatordump taken in the same state as the captures on this pull request; Metro logged a fullAndroid Bundled … apps/mobile/index.jsline with 8039 modules before the measurements.Kiloのロゴ,Kiloへようこそ,Googleでサインイン,パスキーでサインイン,または,メールアドレス,メールで続行,続行,その他のサインイン方法,言語, and the typed address stays in the field./api/device-auth/tokensapproved from the same local stack), changed the app language Japanese → Hungarian in Settings → Account → Language, signed out. The resulting sign-in screen exposesKilo-logó,Üdv a Kilo világában,Bejelentkezés Google-fiókkal,Bejelentkezés jelkulccsal,vagy,E-mail-cím, the empty-field placeholder,Folytatás e-maillel,Folytatás,További bejelentkezési lehetőségek,Nyelv. The email field is empty, which is the draft clear now owned bysignIn.vitest run src/lib/auth src/components/login-screen.test.ts src/lib/login-draft.test.ts634 passed,pnpm --filter kilo-app run typecheckclean, oxlint and oxfmt clean on the changed files.Production prerequisites
None.
Proxy answers
The owner's proxy gave these answers in the owner's place.
Answer: Ship defensive remount
Confidence: 0.55 · Precedent: Autonomy: 'If a defect does not reproduce in your environment, ship the reasonable fix and close the task'; session 9dc66123e7f3 owner chose 'Merge fix(mobile): polish quick chat composer edge and session list loading rows #7613 and close this' over checking on device
Answer: Keep retrying the review trigger
Confidence: 0.65 · Precedent: Never accept blocked as an end state: session 55c9c80332a7, "blocked is not an acceptable end state"; session 2f71af3a787e, "a work item must converge"
Answer: Add one more real test case and push
Confidence: 0.60 · Precedent: Autonomy and decisions: never accept blocked as an end state (session 2f71af3a787e, "a work item must converge"); fix the class of issue (session 7f3470e0ba6f, "fix class of issue preventing progress")
Answer: Neither. iOS proof is possible, so neither 'demonstrated' with an iOS gap nor a parked block is acceptable. A lane gate that declines a JS-only change is a workflow bug: fix that class so an explicit request gets an iOS lane. Then explicitly request the iOS lane on the Mac, tunnel it to the VM, and run the Arabic → Japanese → sign-out flow. Capture the iOS accessibility snapshot of the heading, the Apple, Google and passkey buttons, the email field and the globe. Keep the Android before/after and add a uiautomator dump. Upload the screenshots to the PR in a comment, and only then write the Evidence line as demonstrated on both platforms, which clears insufficient-e2e. If the lane is busy, wait for it to free up.
Confidence: 0.65 · Precedent: Proof and verification: 'Both iOS and Android need to be verified' (dbc5bc930eda) and
missing-e2eonly if proof is impossible (7f3470e0ba6f); Autonomy: 'blocked is not an acceptable end state', treat a block as a workflow bug (55c9c80332a7); Infrastructure: 'iOS lane must specifically be asked for by the agent' (2f71af3a787e)Answer: End handled with the Android E2E evidence at proofHead 9830700 (surfaces mobile-ui + native-android) as the full proof. The change is JavaScript only and not iOS-specific, so Android on the VM is the correct lane. Do not plant a marker to get around the gate. Do not hand an iOS run to the owner. Add an e2eBlocker or missing-e2e only if the end tool requires one. In the PR description, note that the explorer saw the defect on iOS and that the fix is platform-agnostic JS, verified on Android.
Confidence: 0.60 · Precedent: Infrastructure and fleet: iOS lane only when iOS-specific — session 684b43ad7a77, "just because a defect was found on iOS, doesn't mean it needs to be verified on iOS (unless iOS specific)"