Mobile SDK extraction, MobileRouter, CI gates, mounted test harness, and font bundle trim

[iscekic]

Mobile-audit package W1-C — "SDK and CI foundation." Packaging, CI, test-infrastructure, and bundle-size work. No user-facing feature, trigger, message, or CTA changes; runtime behavior and rendered UI are unchanged (only import paths, type surfaces, CI selection, test tooling, and shipped font bytes change).

Slices

• cloud-agent-sdk extraction (packages/cloud-agent-sdk): moved the SDK source out of apps/web into a workspace package that ships TypeScript source via its exports map (no rolled dist). Rewrote intra-package @/ specifiers, gave SendMessagePayload a single client-safe home in the package, and migrated all 28 web import sites. No dual source.
• Mobile resolves the package (56b): all 75 mobile import sites use @kilocode/cloud-agent-sdk; removed the three divergent resolvers (the tsconfig/metro/vitest cloud-agent-sdk + web-pointing aliases) while preserving the app-wide @/* → ./src/* alias. One source, one resolution path.
• Client-safe MobileRouter (packages/trpc): new src/mobile.ts → dist/mobile.d.ts + a ./mobile export subpath; the 9 mobile RootRouter consumers now import @kilocode/trpc/mobile. Web (RootRouter/dist/index.d.ts) is unchanged. dist/mobile.d.ts is 48.75% smaller than dist/index.d.ts (582,744 vs 1,137,085 bytes).
• Mobile test job + release gate: kilo-app-ci.yml now runs pnpm --filter kilo-app test and exposes workflow_call; kilo-app-release.yml gates build-and-submit on validation via uses: (intra-workflow needs:).
• Dependency-aware change selection: extended the kilo-app-ci.yml / kilo-app-release.yml path filters to the real mobile-input packages, and made scripts/changed-workspaces.sh walk the workspace:* dependency graph (pnpm --filter "...^<name>" dependents + the changed package), instead of the blanket all-workspaces flag. Force-all is kept only for lockfile/workspace-yaml/loose packages/* changes.
• Comparison SHA by GitHub event: changed-workspaces.sh now reads the push before SHA from $GITHUB_EVENT_PATH (all-zeros/invalid → HEAD~1), so a push to main no longer produces an empty validation matrix; pull_request and local runs keep merge-base behavior.
• Mounted test harness: a Vitest projects split keeps the existing pure suite unchanged and adds a DOM-free mounted project (react-test-renderer, node env, no jsdom). renderWithProviders provides QueryClientProvider + a fresh test client, plus one representative mounted test asserting a TanStack Query pending→success transition.
• Font bundle trim: deep-import only the two used JetBrains weights, and a Metro resolveRequest shim resolves the unused Material Symbols chain to an empty module (the app renders lucide icons and never mounts NativeTabs/SymbolView).

Measured bundle impact (expo export, before → after)

Platform	Bundled font/asset bytes before	after	removed
Android	8,618,508	260,212	~7.97 MB (Material Symbols 6.72 MB + 14 unused JetBrains weights 1.63 MB)
iOS	1,895,233	261,217	~1.56 MB (14 unused JetBrains weights; iOS never bundled Material)

Material .ttf count is 0 on both platforms after the change; JetBrains drops from 16 weights to 2. Both platform exports succeed with the shim in place (Metro resolves the full <Tabs> graph).

Validation

• Mobile: typecheck, lint, check:unused, format, and test (206 files / 1641 tests) green.
• Web: typecheck + lint green (28 migrated import sites). cloud-agent-sdk: typecheck + tests (27 suites / 1045 tests) green. @kilocode/trpc builds.
• CI/shell changes exercised via simulated changed-file sets (packages/app-shared, packages/cloud-agent-sdk, apps/mobile, a non-mobile web change) and simulated push/pull_request/all-zeros base SHAs.

No device E2E: every acceptance criterion is targeted / CI / artifact / bundle. The expo export measurements and CI simulations are the evidence.

Notes / follow-ups (non-blocking)

• The metro Material-Symbols shim is safe because the app never renders SymbolView; if a future change adds native Android tab icons via expo-symbols, the shim (which resolves those modules to empty) must be revisited. This invariant is documented inline in metro.config.js.
• changed-workspaces.sh's event/dependent logic is verified by inspection and simulation; a scripted unit test for the push/all-zeros path is a reasonable future addition.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

This is a mechanical SDK/package extraction and CI-tooling PR (import-path rewrites, new workspace packages, font-bundle trim, CI gating) with no behavior-changing logic in the reviewed diff; no security, correctness, or memory-leak issues were found in changed lines.

Files Reviewed (226 files)

• .github/workflows/kilo-app-ci.yml, .github/workflows/kilo-app-release.yml, .oxlintrc.json, scripts/changed-workspaces.sh
• apps/mobile/metro.config.js, apps/mobile/package.json, apps/mobile/tsconfig.json, apps/mobile/vitest*.config.ts
• apps/mobile/src/app/**, apps/mobile/src/components/agents/** (chat composer, session cards, tool-cards, part renderers)
• apps/mobile/src/lib/**, apps/mobile/src/test/render-with-providers*.tsx
• apps/web/src/components/cloud-agent-next/**, apps/web/src/hooks/**, apps/web/src/lib/**, apps/web/src/routers/**, apps/web/src/types/opencode.gen.ts
• packages/app-shared/**, packages/cloud-agent-sdk/** (all core src, tests, fixtures, config)
• packages/trpc/src/mobile.ts, packages/trpc/rollup.config.mjs, packages/trpc/package.json

Special attention was given to the Metro resolveRequest Material-Symbols shim (correctly matches only the target package/subpaths and falls back to the upstream resolver) and the new @kilocode/cloud-agent-sdk-facing MobileRouter in packages/trpc/src/mobile.ts (marked server-only, composes only non-admin/non-sensitive routers appropriate for mobile) — both verified sound.

---

_{Reviewed by claude-sonnet-5 · Input: 32 · Output: 17.3K · Cached: 863.8K}

_{Review guidance: REVIEW.md from base branch main}