feat(cli): support remote slash commands and session creation

[iscekic]

Summary

• advertise a bounded, remote-safe slash command catalog and execute structured commands from connected clients
• run real /compact semantics through the CLI command boundary without exposing terminal-local commands
• create root sessions in the current workspace for remote /new, attach them immediately, and return the new session ID
• keep presence-owned and pending-created session announcements race-safe

Coordinated change

• Cloud/mobile PR: feat(mobile): support remote CLI slash commands cloud#4547

Verification

• bun test test/kilocode/sessions/attached-state.test.ts test/kilocode/sessions/remote-command.test.ts test/kilocode/sessions/remote-sender.test.ts test/kilocode/kilo-sessions.test.ts (93 passed)
• bun run --cwd packages/opencode typecheck
• push hooks: full monorepo TypeScript checks and JetBrains typecheck passed
• local mobile E2E against the coordinated cloud branch: command discovery, real /compact, /new session creation, and retryable disconnect behavior

Notes

• This PR intentionally excludes the separate runtime-presence/heartbeat-ack work from the original development branch.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Reviewed the incremental diff since the last review (8f9b36f..ae8e62e), scoped to this PR's files. The new commits add a remote graceful-exit feature (exit_cli RPC command, RemoteExit registry, and a parent/worker RPC bridge for the embedded TUI worker) plus the exit entry in the remote slash-command catalog.

All 5 previously-flagged findings remain resolved (confirmed via line: null on the underlying review comments, i.e. outdated/superseded by later commits).

No new bugs, security, or performance issues found in the new code:

• exit_cli validates the request shape and session id before ACK, never leaks internal error messages (only error.name), and rejects exit from being dispatched through the normal send_command path via RemoteCommand.executable().
• RemoteExit's token-guarded register/get correctly avoids a stale tuiGone/shutdown clobbering a newer registration (covered by tests).
• The parent/worker remote-exit RPC bridge (remote-exit-bridge.ts, remote-exit-worker.ts) bounds both tuiReady and tuiGone with withTimeout and always unsubscribes/continues TUI startup even if the worker never replies.
• RemoteCommand.build()/truncate() correctly extend the existing compact-preservation logic to also preserve a synthesized exit entry without changing truncation semantics for the byte/count caps.

Note: This range adds a new user-facing capability (remote CLI exit) but .changeset/remote-session-slash-commands.md was not updated to mention it — worth a quick check that release notes should cover the new exit_cli behavior.

Files Reviewed (8 files in this range)

• packages/opencode/src/cli/cmd/tui/thread.ts
• packages/opencode/src/cli/cmd/tui/worker.ts
• packages/opencode/src/kilo-sessions/remote-command.ts
• packages/opencode/src/kilo-sessions/remote-exit.ts
• packages/opencode/src/kilo-sessions/remote-sender.ts
• packages/opencode/src/kilocode/cli/cmd/tui/remote-exit-bridge.ts
• packages/opencode/src/kilocode/cli/cmd/tui/remote-exit-rpc.ts
• packages/opencode/src/kilocode/cli/cmd/tui/remote-exit-worker.ts

Previous Review Summaries (2 snapshots, latest commit 8f9b36f)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 8f9b36f)

Status: No Issues Found | Recommendation: Merge

All 5 previously-flagged issues have been fixed in the latest commits and verified against current head (8f9b36f):

• remote-sender.ts - orphan session rollback on attachSession failure now implemented (sessionRemove, swallows cleanup errors, re-throws original attach error).
• attached-state.ts - concurrent announce() calls for the same id now share one in-flight promise via an inflight map; a generation counter guards against a stale post-reset() completion clobbering lastSentKey.
• remote-command.ts - execute() now validates input.command against input.catalog before dispatching, independent of the caller's preflight.
• remote-command.test.ts - the retained-message test fixture is now a concrete typed MessageV2.WithParts[], no more as any.
• attached-state.ts - keyOf now uses sorted, length-prefixed ids instead of a "|"-joined string, eliminating the collision case.

No new issues found in the incremental diff (scoped to the actual PR files: kilo-sessions/attached-state.ts, kilo-sessions/remote-command.ts, kilo-sessions/remote-sender.ts, and their tests). The broader commit-range diff includes many unrelated files from a main merge/rebase that are outside this PR's scope per gh pr diff 12224 --name-only.

Files Reviewed (4 files)

• packages/opencode/src/kilo-sessions/attached-state.ts
• packages/opencode/src/kilo-sessions/remote-command.ts
• packages/opencode/src/kilo-sessions/remote-sender.ts
• packages/opencode/test/kilocode/sessions/attached-state.test.ts
• packages/opencode/test/kilocode/sessions/remote-command.test.ts
• packages/opencode/test/kilocode/sessions/remote-sender.test.ts

Previous review (commit 084e08a)

Status: 5 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/kilo-sessions/remote-sender.ts	527	create_session orphans the newly-created session if attachSession fails after sessionCreate succeeds
packages/opencode/src/kilo-sessions/attached-state.ts	95	Concurrent announce() calls for the same id can resolve inconsistently (race not covered by tests)
packages/opencode/src/kilo-sessions/remote-command.ts	199	execute() relies entirely on the caller to enforce the remote-safe command catalog allowlist rather than validating input.command against input.catalog itself

SUGGESTION

File	Line	Issue
packages/opencode/test/kilocode/sessions/remote-command.test.ts	469	as any cast on test fixture, avoid per style guide
packages/opencode/src/kilo-sessions/attached-state.ts	54	keyOf's `"

Files Reviewed (8 files)

• .changeset/remote-session-slash-commands.md - no issues (user-facing changeset description, correct minor bump)
• packages/opencode/src/kilo-sessions/attached-state.ts - 2 issues
• packages/opencode/src/kilo-sessions/kilo-sessions.ts - no issues in changed lines
• packages/opencode/src/kilo-sessions/remote-command.ts - 1 issue
• packages/opencode/src/kilo-sessions/remote-sender.ts - 1 issue
• packages/opencode/test/kilocode/sessions/attached-state.test.ts - no issues
• packages/opencode/test/kilocode/sessions/remote-command.test.ts - 1 issue
• packages/opencode/test/kilocode/sessions/remote-sender.test.ts - no issues

All touched paths live under Kilo-owned directories (kilo-sessions, test/kilocode, .changeset) — no shared upstream opencode files were modified, so no fork-merge-hygiene concerns apply.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5 · Input: 56 · Output: 18.4K · Cached: 2.2M}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

@kilocode-bot review the latest head

[kilo-code-bot]

To use Kilo from GitHub you first need to link your GitHub account to Kilo. Link your Kilo account to continue. After linking, mention me again in this issue or pull request.