fix(mobile): make secure-store calls total and report failures

[iscekic]

Changelog for users

• A locked or unavailable keychain no longer rejects into the app as an unhandled error.
• Sign-in that cannot store a credential lands on its recoverable error state instead of publishing a half-written session.
• A consent or preference switch that fails to save rolls back and shows a "couldn't save" message.
• Recent PRs, viewed-file marks, and glanceable hints read as empty on a failed read instead of rejecting into the screen.
• A list that cannot be read before an update stays untouched instead of being overwritten with an empty one.
• Every failed secure-store operation reports one warning event tagged with the operation (read, write, or delete).

Changelog for maintainers

• Review secure-store.ts first; the wrapper reports a warning with fingerprint ['secure-store-failure', operation], attaches no key or stored value, and rethrows so callers keep owning recovery.
• readStoredValueSafe, readStoredValueForUpdate, writeStoredValueSafe, and deleteStoredValueSafe are total; readStoredValue, writeStoredValue, and deleteStoredValue report and rethrow.
• Every mobile expo-secure-store import routes through the guarded module or the value helpers; direct imports remain only in tests.
• secureStoreOptionsArgs keeps a no-options call one-argument, so mocks matching the exact argument list stay valid.
• readStoredValueWithRetry reports an exhausted credential read once, not once per attempt.
• Read-modify-write callers abort on an unreadable record, so a failed read cannot persist a list derived from an empty one.
• writeVoiceNetworkConsent resolves false on failure and notifies subscribers only after the store succeeds.
• The device capture ran on an unrecorded platform, so Android behavior is not independently confirmed.

E2E proof

[e1] signs in, stores a credential, and reads it back — Sign-in stores the credential (e1-nextjs.log: "route":"/api/auth/native/otp" then "route":"/api/auth/native/token", both ok:true) and a cold relaunch reads it back with no new otp/token (e1-nextjs.log: "path":"user.getMe","userId":"6c0fd812-9c88-493d-b434-1cabb4c91c10"); happy state scene e1 OK (e1-scene.log, e1.png, replay e1.replay.json). Failure path proven live via a temporary secure-store fault hardcode, reverted (clean tree): handled retryable state 'Could not load your account'/'Something went wrong'/'Retry loading account'/'Sign out' (e1-fault-scene.log, e1-fault.png), Retry…

[e1] signs in, stores a credential, and reads it back

E2E proof — log excerpts

[e1] signs in, stores a credential, and reads it back -> pass :: Sign-in stores the credential (e1-nextjs.log: "route":"/api/auth/native/otp" then "route":"/api/auth/native/token", both ok:true) and a cold relaunch reads it back with no new otp/token (e1-nextjs.log: "path":"user.getMe","userId":"6c0fd812-9c88-493d-b434-1cabb4c91c10"); happy state scene e1 OK (e1-scene.log, e1.png, replay e1.replay.json). Failure path proven live via a temporary secure-store fault hardcode, reverted (clean tree): handled retryable state 'Could not load your account'/'Something went wrong'/'Retry loading account'/'Sign out' (e1-fault-scene.log, e1-fault.png), Retry re-attempts and stays recoverable (e1-fault-retry-scene.log, e1-fault-retry.png). Plan defect: that failure pa

/home/igor_kilocode_ai/.local/share/kwf/sections/req-secure-store-35dc/e2e-mobile-app/e1-nextjs.log

 GET /api/app/min-version 200 in 14ms (next.js: 5ms, proxy.ts: 4ms, application-code: 5ms)
{"type":"trpc_timing","surface":"trpc","durationMs":0,"ok":true,"client":"mobile","platform":"android","version":"1.0.12","requestId":"req-mudq2it2-95yq5ejtoyo","path":"user.getMe","procedureType":"qu
 POST /api/trpc/user.getMe 200 in 33ms (next.js: 10ms, proxy.ts: 7ms, application-code: 16ms)
{"type":"trpc_timing","surface":"trpc","durationMs":0,"ok":true,"client":"mobile","platform":"android","version":"1.0.12","requestId":"req-mudq2it2-gjaivny4slb","path":"user.getMe","procedureType":"qu
 POST /api/trpc/user.getMe 200 in 45ms (next.js: 14ms, proxy.ts: 7ms, application-code: 24ms)
{"type":"trpc_timing","surface":"trpc","durationMs":2,"ok":true,"client":"mobile","platform":"android","version":"1.0.12","requestId":"req-mudq2j7t-sdtv39yxfw","path":"kiloChat.getToken","procedureTyp
{"type":"trpc_timing","surface":"trpc","durationMs":5,"ok":true,"client":"mobile","platform":"android","version":"1.0.12","requestId":"req-mudq2j7t-sdtv39yxfw","path":"kiloclaw.listAllInstances","proc
{"type":"trpc_timing","surface":"trpc","durationMs":6,"ok":true,"client":"mobile","platform":"android","version":"1.0.12","requestId":"req-mudq2j7t-sdtv39yxfw","path":"organizations.list","procedureTy
{"type":"trpc_timing","surface":"trpc","durationMs":17,"ok":true,"client":"mobile","platform":"android","version":"1.0.12","requestId":"req-mudq2j7t-sdtv39yxfw","path":"cliSessionsV2.list","procedureT
 POST /api/trpc/organizations.list,kiloclaw.listAllInstances,kiloChat.getToken,cliSessionsV2.list?batch=1 200 in 39ms (next.js: 7ms, proxy.ts: 5ms, application-code: 27ms)

/home/igor_kilocode_ai/.local/share/kwf/sections/req-secure-store-35dc/e2e-mobile-app/e1-scene.log

android.widget.Button Agents, tab, 2 of 3 tappable [360,2195][720,2337]
android.widget.TextView AGENTS tappable [373,2281][707,2320]
android.widget.Button Profile, tab, 3 of 3 tappable [720,2195][1080,2337]
android.widget.TextView PROFILE tappable [733,2281][1067,2320]
SCENE e1 OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]
android.view.View Kilo tappable [37,84][1043,189]
android.widget.TextView LIVE NOW tappable [36,217][537,254]
android.widget.Button See all tappable [555,216][1043,255]
android.widget.TextView SEE ALL tappable [897,216][1043,255]
android.widget.TextView Nothing running right now tappable [348,363][732,409]
android.widget.Button New coding task tappable [37,537][1043,653]
android.widget.TextView New coding task tappable [450,571][696,617]
android.widget.Button New task from a picture tappable [37,671][1043,787]
android.widget.TextView New task from a picture tappable [396,705][749,751]
android.widget.TextView EXPLORE tappable [36,822][1044,859]
android.widget.Button Code Reviewer, Automatic PR reviews tappable [37,878][1043,879]
android.widget.Button Home, tab, 1 of 3 tappable [0,2195][360,2337]
android.widget.TextView HOME tappable [13,2281][347,2320]
android.widget.Button Agents, tab, 2 of 3 tappable [360,2195][720,2337]
android.widget.TextView AGENTS tappable [373,2281][707,2320]
android.widget.Button Profile, tab, 3 of 3 tappable [720,2195][1080,2337]
android.widget.TextView PROFILE tappable [733,2281][1067,2320]

/home/igor_kilocode_ai/.local/share/kwf/sections/req-secure-store-35dc/e2e-mobile-app/e1-fault-scene.log

SCENE e1-fault OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]
android.widget.ScrollView centered-state tappable [0,0][1080,2400]
android.view.ViewGroup centered-state-content tappable [0,988][1080,1413]
android.widget.TextView Could not load your account tappable [276,988][804,1053]
android.widget.TextView Something went wrong tappable [276,1071][804,1117]
android.widget.Button Retry loading account tappable [55,1154][1025,1270]
android.widget.TextView Retry tappable [500,1188][579,1234]
android.widget.Button Sign out tappable [55,1297][1025,1413]
android.widget.TextView Sign out tappable [478,1331][601,1377]

/home/igor_kilocode_ai/.local/share/kwf/sections/req-secure-store-35dc/e2e-mobile-app/e1-fault-retry-scene.log

SCENE e1-fault-retry OK
android.widget.LinearLayout com.kilocode.kiloapp:id/action_bar_root tappable [0,0][1080,2400]
android.widget.FrameLayout android:id/content tappable [0,0][1080,2400]
android.widget.ScrollView centered-state tappable [0,0][1080,2400]
android.view.ViewGroup centered-state-content tappable [0,988][1080,1413]
android.widget.TextView Could not load your account tappable [276,988][804,1053]
android.widget.TextView Something went wrong tappable [276,1071][804,1117]
android.widget.Button Retry loading account tappable [55,1154][1025,1270]
android.widget.TextView Retry tappable [500,1188][579,1234]
android.widget.Button Sign out tappable [55,1297][1025,1413]
android.widget.TextView Sign out tappable [478,1331][601,1377]

/home/igor_kilocode_ai/.local/share/kwf/sections/req-secure-store-35dc/e2e-mobile-app/e1-mobile.log

Android apps/mobile/index.js ░░░░░░░░░░░░░░░░  0.0% (0/1)
Android Bundled 872ms apps/mobile/index.js (1 module)
Android Bundled 438ms apps/mobile/index.js (1 module)
Android Bundled 96ms apps/mobile/src/lib/persist/encrypted-kv.ts (1 module)
Android Bundled 53ms apps/mobile/src/lib/app-actions/native-bridge.ts (1 module)
 WARN  [Reanimated] Reduced motion setting is overwritten with mode 'system'.
Android Bundled 100ms apps/mobile/src/lib/persist/drafts.ts (1 module)
 WARN  InteractionManager has been deprecated and will be removed in a future release. Please refactor long tasks into smaller ones, and  use 'requestIdleCallback' instead.
 LOG  Success
 LOG  Success
 LOG  Success
 LOG  [screen-tracking] (app)/(tabs)/(0_home)

Owner request

Surface: mobile-app

Production users hit a native secure-store failure. Two live issues carry 112
affected users between them, the second highest user count in the whole
kilo-app project.

The evidence (production, last 24 hours)

• KILO-APP-89, 2184 events, 254 users, live on 9 releases through
  1.0.11+252:
  Error: FunctionCallException: Calling the 'setValueWithKeyAsync' function has failed
• KILO-APP-56, 25 users:
  Error: FunctionCallException: Calling the 'getValueWithKeyAsync' function has failed

Both are expo-secure-store calls rejecting at the Expo Modules layer. The
issue is not soft: a failed getValueWithKeyAsync means the app cannot read a
stored credential, so the user is signed out or blocked.

What to build

1. Find the call sites of setValueWithKeyAsync and getValueWithKeyAsync and
   establish which key and which input makes the native call throw. The values
   are keys and credentials, so read them from the event context, never print
   them.
2. Make the call total. A secure-store failure must not reject into the caller
   as an unhandled error. Handle the rejection, and take the app to a recoverable
   state instead of a broken one.
3. Report the failure as a warning-level telemetry event with a stable
   fingerprint that names the operation, not the raw native message.

Do not log the stored value, the key material, or the credential.

Proof

One must-run scenario that signs in, stores a credential, and reads it back.
Quote the decisive log lines from the scenario in the pull request body.
Include one log line from the failure path that shows the handled outcome.

Follow-ups (not changed here)

• not proved live: One must-run scenario that signs in, stores a credential, and reads it back. Quote the decisive log lines from the scenario in the pull request body. Include one log line from the failure path that shows the handled outcome. (no capture cited it)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of head b4ea0738: the only PR-authored change since 4472e895 is in credentials.ts and its test, where a later sequential credential operation that rejects now clears the partial credential set before rethrowing the original failure, resolving the previous credentials.ts:127 finding.

Files Reviewed (2 files)

• apps/mobile/src/lib/auth/credentials.ts - no new issues; previous WARNING resolved
• apps/mobile/src/lib/auth/credentials.test.ts - no new issues

Verification

• git diff 4472e895..b4ea0738 touches only credentials.ts and credentials.test.ts (102 insertions, 8 deletions).
• The new committedAny flag is set only after a credential write/delete resolves, so a failure on the first operation (credentials.ts:161-165) leaves the previous session untouched and makes no cleanup deletes; the test at credentials.test.ts:298-317 pins this, including deleteItemAsync not called.
• A rejection on a later operation reaches the catch at credentials.ts:146-159, which calls clearPartialCredentials() in the same serialized writeCredentials slot and rethrows the original error; cleanup failures are swallowed so they cannot mask it. Tests at credentials.test.ts:242-296 cover both the partial-set wipe and the cleanup-failure path.
• writeStoredValue/deleteStoredValue each issue exactly one setItemAsync/deleteItemAsync, and chainSave returns the real rejection to the caller, so the mockImplementationOnce/mockRejectedValueOnce sequencing in the new tests matches the production call order.
• The epoch-move paths (commitWrite pre-check and post-check) are unchanged by this commit; no new ordering or stale-publish behavior is introduced.

Previous Review Summaries (4 snapshots, latest commit 4472e89)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 4472e89)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the rebased head 4472e895: the only PR-authored changes since cae13d8b are in secure-store-read.ts and its test, where the env-gated E2E fault error no longer embeds the key and the test now pins the no-key telemetry invariant; the rebase merged main's readWithRetry refactor and the exhausted-read report was correctly carried into the shared loop.

Files Reviewed (2 files)

• apps/mobile/src/lib/auth/secure-store-read.ts - no new issues
• apps/mobile/src/lib/auth/secure-store-read.test.ts - no new issues

Verification

• git range-diff 58cc6899f..cae13d8b 019d7727c..4472e895 shows the PR patch differs from the previously reviewed head only in secure-store-read.ts, secure-store-read.test.ts, and main-drift imports in auth-context.tsx and credentials.ts; the latter two patches are otherwise byte-identical, so the rebase introduced no PR-authored change there.
• secure-store-read.ts:54 throws E2eInjectedFaultError('E2E secure-store fault window is open: read rejected'), so the error attached by reportSecureStoreFailure at secure-store-read.ts:132 carries no key; the test at secure-store-read.test.ts:283-297 asserts the name, message, warning level, fingerprint, and that the serialized event does not contain auth-token.
• The report sits in the shared readWithRetry final attempt, so both exports report an exhausted read exactly once; main's readStoredValueRetryingNull inherits the same single-report behavior.
• The previous WARNING on recent-prs.ts:143 remains resolved: system-search-collect.ts:567-569 calls getRecentPrsForIndex() and returns { documents: [], observedSources: [] } on undefined, so a failed read claims no recents scope.

Previous review (commit cae13d8)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the fix commits since fb4189d: the only PR file that changed is recent-prs-unreadable.test.ts, whose previously flagged ineffective raw-bytes assertion was removed and replaced with a meaningful total-resolution pin, and the earlier recent-prs.ts warning stays resolved by getRecentPrsForIndex, which the OS search collector still consumes.

Files Reviewed (1 file)

• apps/mobile/src/lib/pr-review/recent-prs-unreadable.test.ts - no new issues; previous SUGGESTION resolved

Verification

• The stays total when the read for a failed-mark fails case asserts markRecentPrFailed resolves when getItemAsync rejects; since chainSave and the auth-epoch helpers issue no getItemAsync call, the injected rejection reaches readStoredValueForUpdate, so the assertion genuinely pins the non-rejection contract.
• The upsert and remove cases assert the raw stored bytes are unchanged and that a follow-up getRecentPrs() still reads the pre-existing list, which pins the abort-on-unreadable behavior because those mutations always write.
• recent-prs.ts:143 warning is resolved: system-search-collect.ts:490-492 calls getRecentPrsForIndex() and returns { documents: [], observedSources: [] } when it resolves undefined, so a failed read claims no recents scope.

Previous review (commit fb4189d)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/mobile/src/lib/pr-review/recent-prs-unreadable.test.ts	102	The raw-bytes assertion still cannot detect the abort-on-unreadable regression: markRecentPrFailed never writes without a matching entry, so the stored bytes are unchanged whether or not the abort exists.

Files Reviewed (5 files)

• apps/mobile/src/lib/pr-review/recent-prs.ts - previous WARNING resolved by the new getRecentPrsForIndex
• apps/mobile/src/lib/pr-review/recent-prs-unreadable.test.ts - 1 issue
• apps/mobile/src/lib/system-search-collect.ts - previous WARNING resolved; unreadable read no longer claims a recents scope
• apps/mobile/src/lib/system-search-collect.test.ts
• apps/mobile/src/lib/system-search-collect-recents.test.ts

Fix these issues in Kilo Cloud

Previous review (commit e587b11)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/mobile/src/lib/pr-review/recent-prs.ts	143	getRecentPrs now swallows a failed read, so the OS search collector treats an unreadable recents store as authoritatively empty and removes all indexed PR-recents entries.

SUGGESTION

File	Line	Issue
apps/mobile/src/lib/pr-review/recent-prs-unreadable.test.ts	87	The markRecentPrFailed unreadable-read test is vacuous: it passes whether or not the abort-on-unreadable branch exists.

Files Reviewed (48 files)

• apps/mobile/src/components/consent/consent-details.mounted.test.tsx
• apps/mobile/src/components/consent/consent-details.tsx
• apps/mobile/src/glanceable-ios/adopt-activity.ts
• apps/mobile/src/i18n/return-target.ts
• apps/mobile/src/lib/agent-attachments/picker-launch-context.ts
• apps/mobile/src/lib/app-unlock-context.tsx
• apps/mobile/src/lib/auth/account-metadata-write.ts
• apps/mobile/src/lib/auth/admission.ts
• apps/mobile/src/lib/auth/auth-context.tsx
• apps/mobile/src/lib/auth/credentials.ts
• apps/mobile/src/lib/auth/exchange-legacy-token.ts
• apps/mobile/src/lib/auth/logout-cleanup.ts
• apps/mobile/src/lib/auth/pending-external-auth.test.ts
• apps/mobile/src/lib/auth/pending-external-auth.ts
• apps/mobile/src/lib/auth/secure-store-read.test.ts
• apps/mobile/src/lib/auth/secure-store-read.ts
• apps/mobile/src/lib/auth/secure-store-value.test.ts
• apps/mobile/src/lib/auth/secure-store-value.ts
• apps/mobile/src/lib/auth/secure-store.ts
• apps/mobile/src/lib/consent.ts
• apps/mobile/src/lib/feedback.ts
• apps/mobile/src/lib/glanceable/activity-kit-prompt.ts
• apps/mobile/src/lib/glanceable/persist.ts
• apps/mobile/src/lib/glanceable/scope-cross-platform.test.ts
• apps/mobile/src/lib/glanceable/scope.test.ts
• apps/mobile/src/lib/glanceable/scope.ts
• apps/mobile/src/lib/glanceable/waiting-ask.ts
• apps/mobile/src/lib/glanceable/widget-actions.ts
• apps/mobile/src/lib/hooks/use-persisted-agent-session-filters.ts
• apps/mobile/src/lib/kiloclaw-tab-ownership.ts
• apps/mobile/src/lib/last-active-instance.test.ts
• apps/mobile/src/lib/last-active-instance.ts
• apps/mobile/src/lib/last-opened-session.ts
• apps/mobile/src/lib/login-draft.ts
• apps/mobile/src/lib/organization-context.tsx
• apps/mobile/src/lib/persist/cache-persistence-mount.tsx
• apps/mobile/src/lib/persist/encrypted-kv.ts
• apps/mobile/src/lib/pr-review/recent-prs-unreadable.test.ts - 1 issue
• apps/mobile/src/lib/pr-review/recent-prs.ts - 1 issue
• apps/mobile/src/lib/pr-review/viewed-files.test.ts
• apps/mobile/src/lib/pr-review/viewed-files.ts
• apps/mobile/src/lib/telemetry/secure-store-events.ts
• apps/mobile/src/lib/tour/tour-completion.ts
• apps/mobile/src/lib/trpc.ts
• apps/mobile/src/lib/voice-input/gateway/native-gateway-voice-input.ts
• apps/mobile/src/lib/voice-input/use-voice-input.test.ts
• apps/mobile/src/lib/voice-input/voice-network-consent.test.ts
• apps/mobile/src/lib/voice-input/voice-network-consent.ts

Fix Link

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

kilo-review — independent audit of the published diff.

Status: 2 Issues

File	Line	Issue
apps/mobile/src/components/kiloclaw/onboarding/notifications-step.tsx	2	The onboarding notifications step still imports expo-secure-store directly and calls setItemAsync unguarded, so a failed seen-mark write reports no warning event, violating the change's own 'every failed secure-store operation reports one warning event' and 'direct imports remain only in tests' contracts.
apps/mobile/src/lib/auth/secure-store-read.ts	38	With the env-gated E2E fault window open, the newly added exhausted-read report attaches the fault error whose message embeds the key name, contradicting the 'attaches no key' invariant.

[iscekic]

bot: Accepted. Pushed a132ceb (kwf kwf-fix-review-6f09).

What changed:

• apps/mobile/src/components/kiloclaw/onboarding/notifications-step.tsx:2 — rejected (no_change): the file is an owner-gated Kilo Claw boundary this change must not modify, so its pre-existing direct expo-secure-store import and best-effort seen-mark write stay; both writes already sit inside try/catch and never reject unhandled.
• apps/mobile/src/lib/auth/secure-store-read.ts:38 — accepted: the env-gated fault error no longer embeds the key; it now reads E2E secure-store fault window is open: read rejected, so the exhausted-read report carries no key material; the test asserts the new message and that the emitted event contains no key.
• Review secure-store.ts first; the wrapper reports a warning with fingerprint ['secure-store-failure', operation], attaches no key or stored value, and rethrows so callers keep owning recovery.
• readStoredValueSafe, readStoredValueForUpdate, writeStoredValueSafe, and deleteStoredValueSafe are total; readStoredValue, writeStoredValue, and deleteStoredValue report and rethrow.
• readStoredValueWithRetry reports an exhausted credential read once, not once per attempt.
• Read-modify-write callers abort on an unreadable record, so a failed read cannot persist a list derived from an empty one.
• writeVoiceNetworkConsent resolves false on failure and notifies subscribers only after the store succeeds.
• The device capture ran on an unrecorded platform, so Android behavior is not independently confirmed.

[iscekic]

This description names a scenario the proof did not capture:

• not proved live: One must-run scenario that signs in, stores a credential, and reads it back. Quote the decisive log lines from the scenario in the pull request body. Include one log line from the failure path that shows the handled outcome. (no capture cited it)

A repeated proof run rebuilds the same evidence, so no proof run is dispatched for a named gap. Merging with this gap open is your decision.