[iscekic]

bot: Adds in-app to-do lists to the mobile app. Each list holds the session defaults (repo, mode, model), so one tap starts a session with no extra setup, and any existing session can be linked to a to-do.

• Adds todo_lists, todo_items and todo_item_sessions tables with a tRPC todos router (ownership-scoped, fractional ordering, verified-PR sessions only).
• Adds a To-dos segment to the Agents tab: quick-add, swipe done/delete with undo, drag reorder, linked-session status chips, and an Up next section on Home.
• Starts sessions prefilled from a to-do (long-press sends at once), links existing sessions, shows a To-do chip in chat, and offers Save as to-do in the new-session discard guard.
• Translates the new copy into the mobile catalogs.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-native-sortables@​1.10.1

View full report

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only change since the previous review is a one-line style fix that drops text-center from the to-do list emoji input, which is correct because the shared Input already centers Android text; no new defects were introduced.

Files Reviewed (1 file)

• apps/mobile/src/components/todos/todo-list-settings-sheet.tsx

Previous Review Summaries (4 snapshots, latest commit 979bd39)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 979bd39)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit resolves all five previously reported findings — the fractional-order collision in the to-do move path, the unlinked remote-started to-do, the pending-neighbour reorder rejection, the duplicate title save, and the shared spinner reset — and adds a regression test; the fixes are correct and introduce no new defects.

Files Reviewed (8 files)

• apps/mobile/src/components/agents/new-session-screen-body.tsx
• apps/mobile/src/components/agents/use-remote-spawn-dispatch.ts
• apps/mobile/src/components/todos/todo-detail-screen.tsx
• apps/mobile/src/components/todos/todo-list-screen.tsx
• apps/mobile/src/components/todos/use-start-todo.ts
• apps/mobile/src/lib/use-new-session-share-remote.ts
• apps/web/src/routers/todos-router.ts
• apps/web/src/routers/todos-router.test.ts

Previous review (commit b8015c5)

Status: 5 Issues Found | Recommendation: Address before merge

Executive Summary

The incremental commit only un-exports the todoNewSessionHref helper and drops two unused type aliases; the previously reported fractional-order collision in the to-do move path and the unlinked remote-started to-do remain unfixed.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/routers/todos-router.ts	153	positionForMove trusts client-supplied beforeId/afterId as adjacent siblings; non-adjacent bounds make positionBetween return an existing key, and todo_*.position has no unique constraint, so duplicates persist.
apps/mobile/src/components/agents/new-session-screen-body.tsx	463	todoId reaches only useNewSessionCreator; a session started on a remote instance is never linked to the to-do.
apps/mobile/src/components/todos/todo-list-screen.tsx	186	Reorder neighbours can be optimistic pending:<n> rows; a move adjacent to one sends a non-UUID id that fails z.uuid() validation and rolls back with an error toast.

SUGGESTION

File	Line	Issue
apps/mobile/src/components/todos/todo-detail-screen.tsx	141	onSubmitEditing and onEndEditing both call saveTitle, sending two identical items.update mutations on return.
apps/mobile/src/components/todos/use-start-todo.ts	86	Shared startingTodoId cleared unconditionally by a concurrent startNow, hiding the other row's spinner.

Files Reviewed (2 files changed in this increment)

• apps/mobile/src/components/todos/use-start-todo.ts (incremental change; no new issues)
• apps/mobile/src/lib/todos/todo-types.ts (incremental change; no new issues)

Carried forward after targeted re-verification against current HEAD: apps/web/src/routers/todos-router.ts, apps/mobile/src/components/agents/new-session-screen-body.tsx, apps/mobile/src/components/todos/todo-list-screen.tsx, apps/mobile/src/components/todos/todo-detail-screen.tsx, apps/mobile/src/components/todos/use-start-todo.ts.

Fix these issues in Kilo Cloud

Previous review (commit 7a93f12)

Status: 5 Issues Found | Recommendation: Address before merge

Executive Summary

The incremental commit only mocks the to-do chip inside the session-detail queue test suite; the previously reported fractional-order collision in the to-do move path and the unlinked remote-started to-do remain unfixed.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/routers/todos-router.ts	153	positionForMove trusts client-supplied beforeId/afterId as adjacent siblings; non-adjacent bounds make positionBetween return an existing key, and todo_*.position has no unique constraint, so duplicates persist.
apps/mobile/src/components/agents/new-session-screen-body.tsx	463	todoId reaches only useNewSessionCreator; a session started on a remote instance is never linked to the to-do.
apps/mobile/src/components/todos/todo-list-screen.tsx	186	Reorder neighbours can be optimistic pending:<n> rows; a move adjacent to one sends a non-UUID id that fails z.uuid() validation and rolls back with an error toast.

SUGGESTION

File	Line	Issue
apps/mobile/src/components/todos/todo-detail-screen.tsx	141	onSubmitEditing and onEndEditing both call saveTitle, sending two identical items.update mutations on return.
apps/mobile/src/components/todos/use-start-todo.ts	86	Shared startingTodoId cleared unconditionally by a concurrent startNow, hiding the other row's spinner.

Files Reviewed (6 files)

• apps/mobile/src/components/agents/session-detail-queue.test.ts (incremental change; no issues)
• apps/web/src/routers/todos-router.ts (carried forward)
• apps/web/src/lib/todos/position.ts (collision root cause)
• apps/mobile/src/components/agents/new-session-screen-body.tsx (carried forward)
• apps/mobile/src/components/todos/todo-list-screen.tsx (carried forward)
• apps/mobile/src/components/todos/todo-detail-screen.tsx (carried forward)
• apps/mobile/src/components/todos/use-start-todo.ts (carried forward)

Fix these issues in Kilo Cloud

Previous review (commit b6f6944)

Status: 5 Issues Found | Recommendation: Address before merge

Executive Summary

Fractional-order collisions in the new to-do move path can persist duplicate position keys, and a to-do session started on a remote instance is never linked back to its to-do.

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/routers/todos-router.ts	153	positionForMove treats client-supplied beforeId/afterId as adjacent; non-adjacent bounds make positionBetween return an existing key (e.g. positionBetween('a','c') → 'b'), and there is no unique constraint on position. Reachable since items.move siblings include completed items and lists.move siblings include archived lists.
apps/mobile/src/components/agents/new-session-screen-body.tsx	463	todoId reaches only useNewSessionCreator; a session started on a remote instance (remoteSpawn.onStart()) is never linked to the to-do.
apps/mobile/src/components/todos/todo-list-screen.tsx	186	Reorder neighbours can be optimistic pending:<n> rows; a move adjacent to one sends a non-UUID id that fails z.uuid() validation and rolls back with an error toast.

SUGGESTION

File	Line	Issue
apps/mobile/src/components/todos/todo-detail-screen.tsx	141	onSubmitEditing and onEndEditing both call saveTitle, sending two identical items.update mutations on return.
apps/mobile/src/components/todos/use-start-todo.ts	86	Shared startingTodoId cleared unconditionally by a concurrent startNow, hiding the other row's spinner.

Files Reviewed (110 files)

• apps/web/src/routers/todos-router.ts — 1 issue
• apps/web/src/routers/root-router.ts
• apps/web/src/routers/todos-router.test.ts
• apps/web/src/lib/todos/position.ts — collision root cause (reported via router)
• apps/web/src/lib/todos/position.test.ts
• apps/web/src/lib/todos/git-url-project.ts
• apps/web/src/lib/user/index.ts
• apps/web/src/lib/user/index.test.ts
• packages/db/src/schema.ts
• packages/db/src/schema-types.ts
• packages/db/src/migrations/0276_hard_the_hunter.sql
• packages/db/src/migrations/meta/_journal.json
• packages/trpc/src/mobile.ts
• apps/mobile/src/components/agents/new-session-screen-body.tsx — 1 issue
• apps/mobile/src/components/agents/use-new-session-creator.ts
• apps/mobile/src/components/agents/use-new-session-discard-guard.ts
• apps/mobile/src/components/agents/use-new-session-prefill.ts
• apps/mobile/src/components/agents/new-session-prefill.ts
• apps/mobile/src/components/agents/session-context-sheet.tsx
• apps/mobile/src/components/agents/session-detail-content.tsx
• apps/mobile/src/components/agents/session-list-screen.tsx
• apps/mobile/src/components/agents/tool-card-display.ts
• apps/mobile/src/components/home/home-screen.tsx
• apps/mobile/src/components/todos/* (16 components) — 3 issues
• apps/mobile/src/lib/hooks/use-todos.ts
• apps/mobile/src/lib/todos/*
• apps/mobile/src/lib/app-actions/*
• apps/mobile/src/app/(app)/todos/*, (app)/_layout.tsx, (2_agents)/index.tsx
• apps/mobile/src/i18n/locales/en.json (source catalog) + generated locale catalogs
• services/kilo-mcp/catalog.json (added todos.* entries)
• tools/i18n/check-catalogs.mjs

Notes

• No memory leaks found in the new mobile components (no timers, listeners, subscriptions, or Animated.Values without cleanup).
• MCP catalog additions publish todos.items.delete/todos.lists.delete as mutations; these are ownership-scoped and follow the existing delete-mutation pattern (e.g. agentProfiles.delete, cliSessions.delete), so they are not flagged.
• Migration 0276 is additive-only (three new tables + FKs); no table-locking DDL or unsafe NOT NULL on populated tables.

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 31.9K · Output: 1.7K · Cached: 133.1K}

_{Review guidance: REVIEW.md from base branch main}