fix(cli): isolate release target builds

[lambertjosh]

What changed

• Build each CLI release target in a fresh Bun subprocess while preserving minification and code splitting.
• Keep the parent build responsible for dependency installation, output cleanup, Kilo Console generation, archive creation, and release upload.
• Gate publishing on executing the exact packaged macOS arm64, Linux x64, and Linux arm64 CLI artifacts on native runners.

Root cause

Incorrect root cause, we will unwind the split build changes but keep the kilo CLI arch --version tests which are valuable.

[kilo-code-bot]

SUGGESTION: targets is a direct reference to allTargets when singleFlag is false (line 223: : allTargets), so targets.splice(...) mutates allTargets itself. This doesn't cause a bug today — the child process exits after one build and never reaches allTargets.indexOf(item) — but it's fragile. Consider using a fresh array to avoid the alias:

if (isolated) targets.splice(0, targets.length, allTargets[selection]!)

Could be rewritten as:

const targets = isolated
  ? [allTargets[selection]!]
  : singleFlag
    ? allTargets.filter(...)
    : allTargets

or simply targets.length = 0; targets.push(allTargets[selection]!) if keeping the current structure.

[kilo-code-bot]

SUGGESTION: The child subprocess only receives --skip-install. Other flags like --sourcemaps and --baseline are not forwarded. For release builds this is intentional (sourcemaps are disabled via Script.release), but if someone invokes build.ts --sourcemaps on a multi-target build (non---single), the child processes will silently ignore it.

Consider forwarding extra flags explicitly or documenting that multi-target builds don't support --sourcemaps:

const extraFlags = sourcemapsFlag ? ["--sourcemaps"] : []
await $`${process.execPath} run script/build.ts --target=${allTargets.indexOf(item)} --skip-install ${extraFlags}`

[kilo-code-bot]

SUGGESTION: The validate-darwin-arm64 job (and validate-linux below) is missing if: github.repository == 'Kilo-Org/kilocode' that every other job in this file has (version, build-cli, build-vscode, smoke-test, publish). In practice it doesn't matter since this workflow is only triggered from the main repo, but it breaks the established pattern and could cause confusion in forks.

[kilo-code-bot]

Code Review Summary

Status: 3 Issues Found | Recommendation: Minor suggestions only — safe to merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	3

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/opencode/script/build.ts	224	targets.splice(...) mutates allTargets (aliased reference when singleFlag=false). Safe today since the child exits immediately, but fragile.
packages/opencode/script/build.ts	250	--sourcemaps and --baseline flags not forwarded to child subprocesses. Silently ignored on multi-target builds — fine for releases, unexpected otherwise.
.github/workflows/publish.yml	165	validate-darwin-arm64 and validate-linux jobs are missing if: github.repository == 'Kilo-Org/kilocode' guards that all other jobs in this file have.

Files Reviewed (3 files)

• .changeset/fix-darwin-cli-startup.md — no issues
• .github/workflows/publish.yml — 1 issue
• packages/opencode/script/build.ts — 2 issues

---

The core fix is well-reasoned. The root cause analysis in the PR description is solid — process-level state isolation in Bun's bundler is the right approach. The validation gates in CI close a real gap that allowed broken cross-compiled artifacts to ship.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 1,165,457 tokens}

_{Review guidance: REVIEW.md from base branch main}