feat(provider-review): add server-side GitLab and Bitbucket review layer for mobile (part 1/2)

[iscekic]

Mobile GitLab and Bitbucket had no server-side review layer: only GitHub had an authorized PR surface, a ledger-protected write path, and provider identity contracts. This PR adds that foundation for GitLab and Bitbucket Cloud without regressing the GitHub router.

Changelog for users

• GitLab merge requests and Bitbucket Cloud pull requests now run on a server review surface like GitHub's. It serves detail, changed files, file-line context, discussions, checks, and a review inbox.
• You can comment with inline diff anchors, reply in threads, approve, resolve or reopen discussions, and merge. Retry-safe keys stop a repeated tap from posting twice.
• Merge gates are explicit: required approvals, failing or pending builds, conflicts, drafts, unresolved tasks or discussions, worded by the provider.
• Auto-merge differences are explicit capabilities. GitLab arms merge-when-pipeline-succeeds only with a running pipeline and a pinned head; Bitbucket answers a clear not-exposed-in-API reason.
• GitLab works in personal and organization contexts, including self-managed instances. The connected instance is resolved on the server; a pasted instance URL can never redirect a request.
• Bitbucket Cloud works in organization context. In personal context every entry point explains that an organization with a connected Bitbucket workspace is required.
• Branch selection for new sessions now covers all three providers through one server-resolved endpoint that returns the provider's default branch (GitLab default branch, Bitbucket mainbranch).
• Identity travels with every row and cursor. Same-named repositories across providers, GitLab instances, or Bitbucket workspaces never share keys, caches, or navigation targets, and a moved head refuses a comment or merge.

Changelog for maintainers

• New shared package @kilocode/app-shared/provider-review: provider-discriminated refs, DTOs, providerPrRefKey, and a capability vocabulary with providerPrTerm for provider-correct wording.
• The intent fingerprint gains a provider-split resource plus four intents (resolve_thread, unresolve_thread, enable_auto_merge, disable_auto_merge). An absent or github platform keeps the legacy bytes, so in-flight GitHub keys do not rotate.
• Credentials are server-derived only. GitLab resolves token and instance from the stored integration and refuses a hint whose origin differs. Bitbucket brokers the workspace access token from git-token-service over a new audience-gated endpoint that re-checks integration and workspace identity and answers no-store.
• providerReviewRouter mounts on the root and mobile routers; organization inputs run ensureOrganizationAccess first. githubPrReview is untouched except exporting assertTermsAccepted for the shared terms gate.
• Writes share GitHub's operation ledger, keyed by providerPrRefKey plus a 16-hex-char fingerprint hash. Ambiguous failures mark reconcile_pending; merge reconcile re-reads the authoritative state owner-bound before replay; a partially committed inline batch reports retryable so a retry cannot duplicate comments.
• Pagination is identity-bound: Bitbucket cursors carry collection identity and follow only validated same-origin /2.0/ next URLs inside a repository path guard; GitLab cursors bind page numbers to project or owner identity; responses are size-capped and the GitLab transport pins the DNS-resolved address.
• Review hints: start at provider-review-router.ts (ledger orchestration, error taxonomy) and bitbucket-authorization.ts (token release). Risky spots: the 16-char fingerprint slice behind ledger keys, and enableAutoMerge reusing GitLab's merge endpoint, refused without an active pipeline.
• New unit tests cover authorization refusals, transport and cursor guards, ledger admission and reconcile paths, rejection of client-supplied integration ids, tokens, and hosts, and the frozen GitHub fingerprint bytes.

PR stack (merge bottom to top)

• part 1/2: feat(provider-review): add server-side GitLab and Bitbucket review layer for mobile (part 1/2) #6006 (kwf/bring-mobile-gitlab-and-bitb-3792-l1) ← this PR
• part 2/2: feat(mobile): bring GitLab and Bitbucket code review up to the GitHub workflow (part 2/2) #6021 (kwf/bring-mobile-gitlab-and-bitb-3792-l30)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• apps/web/src/lib/provider-review/gitlab-read.ts
• apps/web/src/lib/provider-review/gitlab-read.test.ts
• apps/web/src/lib/provider-review/bitbucket-read.ts
• apps/web/src/lib/provider-review/bitbucket-read.test.ts

Previous Review Summaries (2 snapshots, latest commit 63f7e56)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 63f7e56)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/provider-review/gitlab-read.ts	611	GitLab inbox defaults to authored MRs, not review requests
apps/web/src/lib/provider-review/bitbucket-read.ts	1128	Bitbucket Cloud PRs have no merge_state; conflicts never block merge

Files Reviewed (38 files)

• apps/web/src/lib/provider-review/gitlab-read.ts - 1 issue
• apps/web/src/lib/provider-review/bitbucket-read.ts - 1 issue
• apps/web/src/lib/provider-review/gitlab-write.ts
• apps/web/src/lib/provider-review/bitbucket-write.ts
• apps/web/src/lib/provider-review/gitlab-authorization.ts
• apps/web/src/lib/provider-review/bitbucket-authorization.ts
• apps/web/src/lib/cloud-agent/provider-branch-listing.ts
• apps/web/src/routers/provider-review-router.ts
• packages/app-shared/src/provider-review/contracts.ts
• packages/app-shared/src/provider-review/capabilities.ts
• packages/app-shared/src/pr-review/intent-fingerprint.ts
• services/git-token-service/src/index.ts
• plus remaining PR files (authorization tests, router tests, branch listing, worker-utils audiences)

Previous review (commit ebe532a)

Status: 9 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	8
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

CRITICAL

File	Line	Issue
apps/web/src/lib/provider-review/bitbucket-write.ts	128	WAT cannot call /2.0/user; Bitbucket review submit fails

WARNING

File	Line	Issue
apps/web/src/lib/provider-review/gitlab-read.ts	371	Missing diff_refs crashes MR detail load
apps/web/src/lib/provider-review/gitlab-read.ts	785	Merge gate only inspects the first 100 discussions
apps/web/src/lib/provider-review/gitlab-read.ts	567	Checks list project pipelines by source SHA, not MR pipelines
apps/web/src/lib/provider-review/gitlab-write.ts	104	waiting_for_resources typo skips MWPS
apps/web/src/lib/provider-review/gitlab-write.ts	491	Already-armed auto-merge skips the head-sha fence
apps/web/src/lib/provider-review/bitbucket-read.ts	940	Inbox pagination drops PRs after sort-and-trim
apps/web/src/lib/provider-review/bitbucket-write.ts	495	Merge uses GitHub commit_message instead of Bitbucket message
apps/web/src/lib/cloud-agent/provider-branch-listing.ts	205	GitLab branch listing skips repository-cache authorization

Files Reviewed (272 files)

• apps/web/src/lib/provider-review/bitbucket-write.ts - 2 issues
• apps/web/src/lib/provider-review/bitbucket-read.ts - 1 issue
• apps/web/src/lib/provider-review/gitlab-read.ts - 3 issues
• apps/web/src/lib/provider-review/gitlab-write.ts - 2 issues
• apps/web/src/lib/cloud-agent/provider-branch-listing.ts - 1 issue
• apps/web/src/lib/provider-review/gitlab-authorization.ts
• apps/web/src/lib/provider-review/bitbucket-authorization.ts
• apps/web/src/routers/provider-review-router.ts
• packages/app-shared/src/provider-review/contracts.ts
• packages/app-shared/src/provider-review/capabilities.ts
• services/git-token-service/src/index.ts
• apps/mobile/src/lib/pr-review/*
• apps/mobile/src/components/pr-review/*
• plus remaining PR files (i18n locales, tests, routing, universal links)

---

_{Reviewed by grok-4.6 · Input: 133.5K · Output: 17.9K · Cached: 802.7K}

_{Review guidance: REVIEW.md from base branch main}