feat(mobile): add per-session auto-approve toggle to the session context sheet

[iscekic]

Changelog for users

• The session context sheet opens with an Auto-approve row at the top.
• Turning Auto-approve on approves this session's permission asks, skips the permission card, and resolves an ask that is already waiting.
• Turning it off makes the next permission ask show its card again.
• The setting applies to one session only, so other sessions keep prompting.
• The row shows on, off, or unavailable and warns that tools then run without a prompt; read-only sessions show it disabled with the reason.
• Clarification questions always show their card and are never auto-answered.
• Changing the Auto-approve switch gives one selection haptic, the same on iOS and Android.
• Signing out or switching accounts turns Auto-approve off for every session.

Changelog for maintainers

• apps/mobile/src/i18n/locales/zu.json:2442 — Rejected (no_change). Removing the translated autoApprove blocks fails the required catalog-parity check: tools/i18n/check-catalogs.mjs:485-489 reports each translated catalog that misses an en.json key, and CI runs pnpm --filter kilo-app run check:i18n at .github/workflows/kilo-app-ci.yml:126. The 86 blocks stay.
• apps/mobile/src/components/agents/session-auto-approve.ts:84 — Accepted. Added clearSessionAutoApprove() to drop every session's toggle and wired it into clearSessionScopedState(), so sign-out and account switch clear the module-global map instead of leaking it.
• apps/mobile/src/components/agents/use-session-auto-approve.ts:47 — Accepted. The handled and failed request-id sets now go through rememberRequestId(), which evicts the oldest id once a set passes a 64-id window, bounding memory for a long session.
• The toggle stays in memory keyed by session id; it never writes the global auto-approve config, and availability follows the transport: remote and cloud-agent sessions are answerable, read-only and unresolved transports are not.
• No session-scoped permission command exists, so the toggle auto-replies once per ask, matching the terminal auto-approve fallback.
• A permission reply reports ok, retryable, or terminal; a retryable failure un-suppresses the card with its Retry action.
• The Auto-approve row reports only the next value; the session screen fires the single cross-platform selection haptic, so one implementation serves iOS and Android.
• Review first the auto-reply wiring and card suppression in session-detail-content.tsx, then the bounded request-id window in session-auto-approve.ts and the sign-out clearing in session-scoped-state.ts. No schema, config, or migration changes.

E2E proof

Superseded and replaced: the earlier no-card "tool runs" captures [p4] and the pre-repair switch-state and second-session captures are replaced by the fresh Android runs [e1], [e2], [e3], and [e4] below. The account-boundary run and the non-English catalog captures (German and Zulu) are new. The reply-failure captures [p8] and [p6] of 2026-09-12 ~16:14-16:25 UTC (head 4672beaf) are retained, and the earlier gallery images stay below. Verification ran on Android; the toggle calls one haptic API shared by iOS and Android, and the emulator reports haptics only through VibratorService, so that record is the haptic source.

[p8] With Auto-approve on, make the permission reply fail once: the permission card appears with Retry while the toggle stays on. — Android emulator-5554, 2026-09-12 ~16:14-16:25 UTC, head 4672beaf5e055f42ebce2634fc5816c8b594806d. The ingest socket was taken down while a remote CLI session held a pending "Allow External Directory? /tmp/*" ask; the auto-approve reply failed, the card returned with a tappable Retry, and the toggle stayed on.

p8-fault.mp4.trim.mp4

[p6] With Auto-approve on, make the permission reply fail once: the permission card appears with Retry while the toggle stays on. — Android emulator-5554. A real pending permission failed because cloudflare-session-ingest was down, so the card returned with Retry and the toggle stayed on.

p6.mp4.trim.mp4

[e5] Android: change the Auto-approve switch and confirm the selection haptic still fires once per commit. — Android emulator-5604: three switch commits produced exactly three VibratorService records, one per commit; the emulator emits no Vibrator/HapticFeedback logcat tag, so the VibratorService record (dumpsys vibrator_manager) is the authoritative source.

e1.mp4

e4-autoapprove-pending.trim.mp4

p6.mp4

Owner manual verification

Owner verification is pending; the excluded checks did not pass automatically.

• No owner-manual scope was assigned for this change.

Owner request

Add a per-session auto-approve toggle to the mobile app.

Surface: mobile-app.

Placement:
The session context sheet opens when the user taps the context info in the top right of the session header.
Put the toggle at the top of that sheet.

Behavior:

• The toggle turns auto-approve on or off for the current session only.
• When it is on, a permission ask from this session is approved automatically and the permission card does not appear.
• Turning it on also resolves a permission ask that is already pending for this session.
• It approves permission asks only. It must not answer clarification questions.
• The toggle shows the current state: on, off, or unavailable.
• Show a short warning that tools then run without a prompt.

Scope:

• The scope is the session. Do not change the global auto-approve rule.
• Do not affect any other session.
• Prefer the session-scoped permission mechanism when the session supports it.
• Otherwise auto-reply to each ask, as the terminal auto-approve does.

Session types:

• Support remote CLI sessions.
• Support cloud agent sessions only when they produce permission asks and the client can answer them.
• Hide or disable the toggle when the session cannot receive permission asks, for example a read-only session.

Constraints:

• Never write the global config from this toggle.
• Keep read-only and no-permission sessions unchanged.
• Do not commit fixtures, E2E-only code, test hooks, or test-only runtime flags.
• Keep temporary test support outside the product diff.
• Do not leave follow-ups.
• Let the workflow open and maintain the PR.
• Finish only after current-head continuous integration (CI) is green and Kilobot recommends Merge.

Verification:

• Add focused unit tests for the toggle state and the auto-reply path.
• Prove on a device: open a session, tap the context info, turn the toggle on, trigger a tool call that needs permission, and show that no prompt appears and the tool runs.
• Prove that turning it off makes the next permission ask show its card.
• Prove that a second session still prompts while the first session has auto-approve on.
• Prove the toggle sits at the top of the context sheet.
• Put the recording, or screenshots if a recording is unavailable, in the pull request (PR) body.

[iscekic]

kilo-review — independent audit of the published diff.

Status: 2 Issues

File	Line	Issue
apps/mobile/src/i18n/locales/af.json	2442	Feature slice edits 86 non-en.json locale catalogs; apps/mobile policy is en.json-only copy edits with the other catalogs translated in a dedicated slice.
dev/seed/app/api-token.ts	3325	The new --env= runtime flag is verification-only support (its comment cites the e2e session helper) committed in the product diff, which the owner request forbids.

[iscekic]

bot: Accepted. Pushed b460347 (kwf kwf-fix-review-f2b4).

What changed:

• apps/mobile/src/i18n/locales/af.json:2442 — Accepted: the feature reworded the auto-approve copy in the non-English catalogs. Restored each catalog's existing translation, so the new copy lives only in the English catalog and no key is added or removed.
• dev/seed/app/api-token.ts:3325 — Accepted: the --env=<name> flag existed only to match the local Next dev server during E2E runs. Removed the flag, its usage text, parse branch, comment, and reported env, so the token environment claim again comes from process.env.NODE_ENV ?? 'development'.
• The toggle lives in an in-memory store keyed by session id; it never writes the global auto-approve config and resets on app restart.
• Availability follows the transport: remote and cloud-agent sessions are answerable; read-only and unresolved transports are not.
• No session-scoped permission command exists, so the toggle auto-replies once per ask, matching the terminal auto-approve fallback.
• A permission reply now reports ok, retryable, or terminal; a retryable failure un-suppresses the card with its Retry action.
• Review first the auto-reply wiring and card suppression in session-detail-content.tsx, then retry handling in use-session-auto-approve.ts. No schema, config, or migration changes.

[iscekic]

bot: Cross-platform fix. Pushed 90f4e18 (kwf kwf-fix-platform-4703).

What changed:

• The row component no longer imports or calls expo-haptics; the screen that owns the session state fires the one cross-platform selection haptic when the toggle changes.
• Haptics.selectionAsync() was already imported by that screen, so the toggle commit reuses the existing cross-platform call; no platform branch and no per-platform module remain.
• A doc comment on the row records that selection haptics are a capability both iOS and Android have, so one implementation serves both.
• The mounted row test drops the expo-haptics import and mock; it now asserts only that the next value is forwarded once.
• The session-detail test hoists a selection-haptic mock and asserts one call per toggle commit, then two after a second commit.
• Review the haptic call site in the screen's auto-approve change handler first; the row's change handler is now a pass-through.
• No schema, config, or migration changes.

[iscekic]

bot: Cross-platform fix. Pushed 2d8b2ce (kwf kwf-fix-platform-4703).

What changed:

• The row component no longer imports or calls expo-haptics; the screen that owns the session state fires the one cross-platform selection haptic when the toggle changes.
• Haptics.selectionAsync() was already imported by that screen, so the toggle commit reuses the existing cross-platform call; no platform branch and no per-platform module remain.
• A doc comment on the row records that selection haptics are a capability both iOS and Android have, so one implementation serves both.
• The mounted row test drops the expo-haptics import and mock; it now asserts only that the next value is forwarded once.
• The session-detail test hoists a selection-haptic mock and asserts one call per toggle commit, then two after a second commit.
• Review the haptic call site in the screen's auto-approve change handler first; the row's change handler is now a pass-through.
• No schema, config, or migration changes.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental re-review of the six files changed since the prior review: clearSessionAutoApprove() is now wired into clearSessionScopedState() and both request-id sets are bounded by rememberRequestId(), so the earlier store-leak and unbounded-growth findings are fixed; no new issues were found in the changed code.

Files Reviewed (6 files)

• apps/mobile/src/components/agents/session-auto-approve.test.ts
• apps/mobile/src/components/agents/session-auto-approve.ts
• apps/mobile/src/components/agents/use-session-auto-approve.mounted.test.tsx
• apps/mobile/src/components/agents/use-session-auto-approve.ts
• apps/mobile/src/lib/auth/auth-context.test.tsx
• apps/mobile/src/lib/auth/session-scoped-state.ts

Previous Review Summary (commit 2d8b2ce)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 2d8b2ce)

Status: 3 Issues Found | Recommendation: Address before merge

Executive Summary

The new per-session auto-approve store never releases state (it is not wired into the sign-out reset) and accumulates request ids without bound, while the PR still hand-edits all 86 non-English locale catalogs against the mobile en.json-only policy.

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/mobile/src/i18n/locales/zu.json	2442	Non-English catalogs hand-edited (all 86), against the en.json-only copy policy.
apps/mobile/src/components/agents/session-auto-approve.ts	84	Module-global enabledBySession is never cleared on sign-out/account switch.

SUGGESTION

File	Line	Issue
apps/mobile/src/components/agents/use-session-auto-approve.ts	47	Handled/failed request-id sets grow without bound for the session lifetime.

Files Reviewed (17 source/test files + 87 locale catalogs)

• apps/mobile/src/components/agents/context-sheet-mount-state.test.ts
• apps/mobile/src/components/agents/context-usage-display.test.ts
• apps/mobile/src/components/agents/context-usage-display.ts
• apps/mobile/src/components/agents/session-auto-approve-row.mounted.test.tsx
• apps/mobile/src/components/agents/session-auto-approve-row.tsx
• apps/mobile/src/components/agents/session-auto-approve.test.ts
• apps/mobile/src/components/agents/session-auto-approve.ts
• apps/mobile/src/components/agents/session-context-metrics.test.ts
• apps/mobile/src/components/agents/session-context-metrics.tsx
• apps/mobile/src/components/agents/session-context-sheet.mounted.test.tsx
• apps/mobile/src/components/agents/session-context-sheet.tsx
• apps/mobile/src/components/agents/session-detail-content.test.ts
• apps/mobile/src/components/agents/session-detail-content.tsx
• apps/mobile/src/components/agents/use-interaction-handlers.test.ts
• apps/mobile/src/components/agents/use-interaction-handlers.ts
• apps/mobile/src/components/agents/use-session-auto-approve.mounted.test.tsx
• apps/mobile/src/components/agents/use-session-auto-approve.ts
• apps/mobile/src/i18n/locales/*.json (en plus 86 translated catalogs)

---

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}