[iscekic]

Evidence

Evidence: demonstrated — a local E2E run on this VM.

Run here on the work VM:

• Android dev client of this branch against the local development stack, signed in to a seeded test account: the StartAgent action URL resolved the named repository and the app opened the created session route, and the backend logged one prepareSession call with the mobile provenance.
• pnpm --filter kilo-app exec vitest run src/lib/app-actions — the app action suites pass, including the contract's repository cases.
• The same action URL with a repository value the contract declines: the app showed its repository refusal state and no prepareSession call appeared in the backend log.

Limitation: the stack's session-detail upstream is a local stand-in, so the opened session's detail body shows its load error. The run covers repository resolution and the outbound request, not a completed agent turn.

Change

One repository-name rule now applies across every supported repository form in the mobile app action contract. Dotted project names and subgroup paths parse as before, a trailing .git still strips, and the Bitbucket result uses the shared parser.

Production prerequisites

None.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: Which path segments should the parser decline?
   Answer: Only . and ..
2. Question: Should the Bitbucket result use the same rule?
   Answer: Decline it as well
3. Question: What should the pull request publish as E2E proof?
   Answer: Accepted-path capture only

[iscekic]

bot: End-to-end capture from the Android emulator on this VM's local dev stack, signed in as a seeded fake account with a seeded fixture GitHub integration.

The StartAgent action URL was fired at the running app with an ordinary two-segment repository value. Metro logged start-agent.ts and start-agent-runtime.ts for the run, the web router logged CloudAgentNextClient.prepareSession with that repository as githubRepo, a session row was created, and the app opened the session in the capture. The empty response line is the local stack having no model provider configured; the session itself came from the action.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The ./.. segment rejection is correctly applied across the bare, scheme:// and git@host: forms, the Bitbucket branch now declines unparsable paths consistently, and the added tests cover both the rejection and dotted-name acceptance.

Assumptions: [INFERENCE] I did not execute the test suite (read-only review); correctness of REPOSITORY_SEGMENT_PATTERN was verified by inspection of every parse path. A Bitbucket value whose path does not parse (for example https://bitbucket.org or https://bitbucket.org/w/../r) now reports unknown-repository instead of unsupported-repository; the message still interpolates the raw value (start-agent.ts:202), so the refusal still names the input and no user-visible capability is lost.

Files Reviewed (2 files)

• apps/mobile/src/lib/app-actions/app-action-contract.ts - no issues
• apps/mobile/src/lib/app-actions/app-action-contract.test.ts - no issues

---

_{Reviewed by deepseek-flash-latest · Input: 60.7K · Output: 8.8K · Cached: 531.7K}

_{Review guidance: REVIEW.md from base branch main}

[eshurakov]

Shallow review: no critical issues found.