feat(mobile): bring GitLab and Bitbucket code review up to the GitHub workflow (part 2/2)

[iscekic]

Changelog for users

• The review inbox and detail view now cover GitLab merge requests and Bitbucket pull requests: files, diffs, discussions, checks, and merges, in the provider's wording.
• GitLab supports personal and organization contexts, including self-managed instances; Bitbucket Cloud is organization-only and explains that in a personal context.
• New sessions select a repository and a branch per provider, and the chosen branch reaches the real session checkout.
• Recents, drafts, viewed-file sets, and pending comments stay separate across providers, owners, GitLab instances, and same-named repositories.
• Merges and comments fence on the exact head and diff anchor; a moved head or stale revision never redirects or misposts.
• Auto-merge appears as an explicit capability: GitLab merges when its pipeline succeeds, and Bitbucket explains that its API has none.
• A provider review opens on the pull/merge-request overview, and badges, pasted URLs, shared links, deep links, and recents open provider reviews in-app.
• The inbox queries only connected providers; a revoked GitHub connection shows a reconnect action, and one provider's failure leaves the other providers' rows visible.

Changelog for maintainers

• apps/mobile/src/app/(app)/pr-review/[platform]/[...identity]/_layout.tsx:116 — accepted: registered index ahead of the sheets, so the overview is the initial provider-review screen; a test runs the router's sorter to lock the order.
• patches/expo-router@57.0.15.patch:1 — accepted: restored the deleted ExpoRouterModule.kt; the patch now carries only the two JavaScript linking fixes, and the lockfile hash was updated.
• apps/mobile/src/lib/pr-review/use-provider-inbox.ts:241 — accepted: GitHub reads now require the user's authorization; revoked access surfaces a reconnect action, and retries re-run the authorization check.
• apps/mobile/src/app/(app)/agent-chat/repo-picker.tsx:201 — accepted: the Bitbucket organization-only note keys on personal context, not on a missing section, so an organization with no Bitbucket rows sees no note.
• Start at the provider review layout: it validates every route segment, publishes the provider scope (ref plus organization), and hosts the comment, review-submit, merge, and file-navigator sheets.
• One identity module and one URL resolver own provider identity; malformed deep links never reach a query, and the GitLab instance hint stays display-only while the server re-derives the instance.
• Viewed files, recents, and pending-review drafts key on the collision-free provider ref; GitHub keeps its legacy storage bytes and runs no migration.
• E2E proof is stack-wide on the tip: scenarios e1–e4 replace the earlier iOS shared-link capture and the moved-head and checks-loading proof.

E2E proof

e1-gitlab-handoff.mp4.trim.mp4

E2E proof — log excerpts

[e1] provider PR/MR detail route renders the overview index -> pass :: android emulator-5554; after db.sh seeded a personal gitlab platform_integrations row (22deb549, deleted after the run), session.sh delivered /pr-review/gitlab/igor352/kilo-e2e-personal/1 and the digest reads 'SCENE e1 OK' with 'Merge request !1', 'Overview', 'Files', 'Discussion' - the index route is the initial screen, not the comment-composer sheet (finding 1).
[e2] personal Bitbucket org-only note in the repo picker -> pass :: android emulator-5554; personal context, New session > Repository picker scrolled past the GitHub rows shows 'SCENE e2b OK' with 'Bitbucket is available for organizations only.' while no Bitbucket section exists, so the note is keyed on context not on a rendered section (finding 4); the org branch is not reachable (no provider repos), see e2-org-context-branch.log.
[e3] unconnected account does not query the GitHub inbox -> pass :: android emulator-5554; signed in as e2e-empty-kwf-fix-review-9910@example.com (0 platform_integrations rows) and opened PR Review: 0 githubPrReview.listInbox in the nextjs window, new trpc calls were only activeSessions.list and personalReviewAgent.getGitLabStatus+githubApps.getUserAuthorization; the connected control with github-stub fired githubPrReview.listInbox 2x (finding 3).
[e4] expo-router patch keeps ExpoRouterModule.kt -> pass :: android emulator-5554/build 057e99fe; patches/expo-router@57.0.15.patch has 'ExpoRouterModule occurrences in the patch: 0' and 'delete-file hunks in patch: 0' (finding 2), and the persisted android app resolves provider routes (e1).

Owner request for the stack

Deliver the work described below as reviewed, CI-green pull requests assigned to @iscekic. Do not merge them. Prove the behaviour on a live build, not with mocks alone. Prefer an existing component, library, or contract over a new one. Do not weaken an existing permission, authorization, or access check. The only text size that matters is the default size. Do not test larger text or themes.

Bring mobile GitLab and Bitbucket up to the level of the existing GitHub workflows. Do not regress GitHub.

Support:

• GitLab in Personal and organization contexts, including existing self-managed instances with their real host and full nested project path.
• Bitbucket Cloud in organization context only, with an understandable state in Personal context.

The whole workflow, per provider:

• Connect, and reach a usable workflow from the integration status entry point.
• Discover and select a repository. Get the default branch from that provider. Select a branch.
• Send the selected branch into the real session checkout, not only the payload.
• Launch an agent with the existing managed server-side credentials.
• Open an inbox and a detail view of pull or merge requests.
• Show files, diffs, expanded context where supported, discussions, build or check state, and merge restrictions.
• Comment, hold inline discussions, and take the supported review and merge actions.
• Express auto-merge and review-status differences as explicit capabilities.
• Open a session-linked review, a pasted URL, a shared link, a deep link, and a notification in the app.
• Use the provider's own wording: pull request or merge request.

Identity rules:

• Carry provider, owner, integration, instance, and repository identity through discovery, selection, pagination, and navigation.
• Two same-named repositories must never cross a provider, owner, integration, or instance boundary.
• A repository or owner change must drop an incompatible selected branch.
• A stale revision or a moved head must never redirect a comment or a merge.
• Caches, recents, drafts, pending comments, and retry keys must not collide across providers.
• Derive credentials and host identity on the server. Never trust a client-supplied host or owner.
• An unsupported action needs a clear explanation. Missing code is not a reason to call a requested feature unsupported.

Reuse one mobile presentation. Do not copy the GitHub screen tree per provider. Use disposable, authorized fixtures for merge and write evidence.

Verification protocol:

• The current build's static gate is the only source of current failure truth. Run the static gate (surface typechecks plus the Vitest/Jest run over the changed and sibling test files) on the current tree first, repair its actual failures, and only then start fresh device verification.
• A device-repair task may only be created from a device verdict produced against the current build; verdict files are archived before each round so a stored verdict never outlives the build it describes. The earlier vr3 and vr4 device-repair tasks are superseded: no device verifier ran in the 16:31 and 16:49 rounds, and their device-failure premise is void.
• Changes made solely to work around obsolete device evidence are undone unless current evidence independently requires them. This removes vr4's uncommitted credential-service transport-retry workaround (git-token-service-request.ts, git-token-service-request.test.ts, and the user-token-client.ts / credential-broker-client.ts call-site changes). All legitimate provider work already delivered stays.
• Historical evidence — the .toSorted failures, the Page-not-found state, and the credential-service outage — is not a current failure unless it reproduces on the current build.

[kilo-code-bot]

Code Review Summary

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

CRITICAL

File	Line	Issue
apps/mobile/src/app/(app)/pr-review/[platform]/[...identity]/_layout.tsx	116	Provider stack never registers index

WARNING

File	Line	Issue
patches/expo-router@57.0.15.patch	1	Patch newly deletes ExpoRouterModule.kt
apps/mobile/src/lib/pr-review/use-provider-inbox.ts	241	GitHub inbox always queried when unconnected

SUGGESTION

File	Line	Issue
apps/mobile/src/app/(app)/agent-chat/repo-picker.tsx	201	Bitbucket org-only note keyed on section

Files Reviewed (4 files)

• apps/mobile/src/app/(app)/pr-review/[platform]/[...identity]/_layout.tsx - 1 issue
• patches/expo-router@57.0.15.patch - 1 issue
• apps/mobile/src/lib/pr-review/use-provider-inbox.ts - 1 issue
• apps/mobile/src/app/(app)/agent-chat/repo-picker.tsx - 1 issue

Fix these issues in Kilo Cloud

Previous Review Summary (commit 35421e1)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 35421e1)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• apps/mobile/src/lib/intl-cache-hermes-surface.test.ts

---

_{Reviewed by grok-4.6 · Input: 433.4K · Output: 29.5K · Cached: 1.8M}

_{Review guidance: REVIEW.md from base branch kwf/bring-mobile-gitlab-and-bitb-3792-l1}